From e1669ccf23ab64aabc8deebf7988a3eff0709d29 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Fri, 13 Mar 2026 15:04:46 -0700 Subject: [PATCH 1/2] remove legacy prow cluster configuration this was used by the google operated prow cluster, current config is in github.com/kubernetes/k8s.io --- .../k8s-prow/cluster-configuration.tf | 129 - config/prow/Makefile | 51 - config/prow/cluster/OWNERS | 6 - .../boskos-resources/boskos-resources.yaml | 339 - .../build/boskos-resources/boskos_test.go | 34 - ...build_kubernetes-external-secrets_crd.yaml | 1 - ...netes-external-secrets_customresource.yaml | 135 - ...ubernetes-external-secrets_deployment.yaml | 1 - ...uild_kubernetes-external-secrets_rbac.yaml | 1 - ...d_kubernetes-external-secrets_service.yaml | 1 - .../build_kubernetes_external_secrets.yaml | 15 - .../cluster/build/build_serviceaccounts.yaml | 85 - .../build/cpu-limit-range_limitrange.yaml | 10 - .../build/create-loop-devs_daemonset.yaml | 58 - config/prow/cluster/build/grandmatriarch.yaml | 61 - .../build/mem-limit-range_limitrange.yaml | 10 - .../cluster/build/test-pods_namespace.yaml | 4 - .../cluster/build/tune-sysctls_daemonset.yaml | 50 - .../prow/cluster/cherrypicker_deployment.yaml | 69 - config/prow/cluster/cherrypicker_service.yaml | 26 - config/prow/cluster/crier_deployment.yaml | 142 - config/prow/cluster/crier_rbac.yaml | 87 - config/prow/cluster/crier_service.yaml | 14 - config/prow/cluster/deck_deployment.yaml | 179 - config/prow/cluster/deck_rbac.yaml | 66 - config/prow/cluster/deck_service.yaml | 33 - .../cluster/gce-ssd-retain_storageclass.yaml | 25 - config/prow/cluster/ghproxy.yaml | 100 - config/prow/cluster/halogen.yaml | 65 - config/prow/cluster/hook_deployment.yaml | 183 - config/prow/cluster/hook_rbac.yaml | 42 - config/prow/cluster/hook_service.yaml | 32 - .../prow/cluster/horologium_deployment.yaml | 59 - config/prow/cluster/horologium_rbac.yaml | 33 - config/prow/cluster/horologium_service.yaml | 14 - config/prow/cluster/ing_ingress.yaml | 35 - .../kube-state-metrics_deployment.yaml | 46 - .../prow/cluster/kube-state-metrics_rbac.yaml | 40 - .../cluster/kube-state-metrics_service.yaml | 19 - .../kubernetes-external-secrets_crd.yaml | 236 - ...ubernetes-external-secrets_deployment.yaml | 41 - .../kubernetes-external-secrets_rbac.yaml | 57 - .../kubernetes-external-secrets_service.yaml | 17 - .../cluster/kubernetes_external_secrets.yaml | 158 - .../prow/cluster/needs-rebase_deployment.yaml | 65 - config/prow/cluster/needs-rebase_service.yaml | 26 - config/prow/cluster/pipeline_deployment.yaml | 43 - config/prow/cluster/pipeline_rbac.yaml | 50 - ...prow-canary-k8s-io_managedcertificate.yaml | 7 - .../prow-k8s-io_managedcertificate.yaml | 7 - ...prow-kubernetes-io_managedcertificate.yaml | 7 - .../prow_controller_manager_deployment.yaml | 142 - .../cluster/prow_controller_manager_rbac.yaml | 112 - .../prow_controller_manager_service.yaml | 28 - ...b-schemaless_customresourcedefinition.yaml | 96 - .../prowjob_customresourcedefinition.yaml | 52786 ---------------- .../prow/cluster/pushgateway_deployment.yaml | 113 - config/prow/cluster/sinker_deployment.yaml | 108 - config/prow/cluster/sinker_rbac.yaml | 96 - config/prow/cluster/sinker_service.yaml | 28 - .../prow/cluster/starter/starter-azure.yaml | 1357 - config/prow/cluster/starter/starter-gcs.yaml | 1242 - .../prow/cluster/starter/starter-s3-kind.yaml | 1432 - config/prow/cluster/starter/starter-s3.yaml | 1374 - .../cluster/statusreconciler_deployment.yaml | 73 - .../prow/cluster/statusreconciler_rbac.yaml | 31 - config/prow/cluster/test-pods_namespace.yaml | 4 - config/prow/cluster/tide_deployment.yaml | 71 - config/prow/cluster/tide_rbac.yaml | 36 - config/prow/cluster/tide_service.yaml | 33 - config/prow/cluster/tls-ing_ingress.yaml | 73 - .../prow/cluster/trusted_serviceaccounts.yaml | 78 - .../prow/experimental/controller_manager.yaml | 123 - 73 files changed, 62450 deletions(-) delete mode 100644 config/clusters/k8s-prow/cluster-configuration.tf delete mode 100644 config/prow/Makefile delete mode 100644 config/prow/cluster/OWNERS delete mode 100644 config/prow/cluster/build/boskos-resources/boskos-resources.yaml delete mode 100644 config/prow/cluster/build/boskos-resources/boskos_test.go delete mode 120000 config/prow/cluster/build/build_kubernetes-external-secrets_crd.yaml delete mode 100644 config/prow/cluster/build/build_kubernetes-external-secrets_customresource.yaml delete mode 120000 config/prow/cluster/build/build_kubernetes-external-secrets_deployment.yaml delete mode 120000 config/prow/cluster/build/build_kubernetes-external-secrets_rbac.yaml delete mode 120000 config/prow/cluster/build/build_kubernetes-external-secrets_service.yaml delete mode 100644 config/prow/cluster/build/build_kubernetes_external_secrets.yaml delete mode 100644 config/prow/cluster/build/build_serviceaccounts.yaml delete mode 100644 config/prow/cluster/build/cpu-limit-range_limitrange.yaml delete mode 100644 config/prow/cluster/build/create-loop-devs_daemonset.yaml delete mode 100644 config/prow/cluster/build/grandmatriarch.yaml delete mode 100644 config/prow/cluster/build/mem-limit-range_limitrange.yaml delete mode 100644 config/prow/cluster/build/test-pods_namespace.yaml delete mode 100644 config/prow/cluster/build/tune-sysctls_daemonset.yaml delete mode 100644 config/prow/cluster/cherrypicker_deployment.yaml delete mode 100644 config/prow/cluster/cherrypicker_service.yaml delete mode 100644 config/prow/cluster/crier_deployment.yaml delete mode 100644 config/prow/cluster/crier_rbac.yaml delete mode 100644 config/prow/cluster/crier_service.yaml delete mode 100644 config/prow/cluster/deck_deployment.yaml delete mode 100644 config/prow/cluster/deck_rbac.yaml delete mode 100644 config/prow/cluster/deck_service.yaml delete mode 100644 config/prow/cluster/gce-ssd-retain_storageclass.yaml delete mode 100644 config/prow/cluster/ghproxy.yaml delete mode 100644 config/prow/cluster/halogen.yaml delete mode 100644 config/prow/cluster/hook_deployment.yaml delete mode 100644 config/prow/cluster/hook_rbac.yaml delete mode 100644 config/prow/cluster/hook_service.yaml delete mode 100644 config/prow/cluster/horologium_deployment.yaml delete mode 100644 config/prow/cluster/horologium_rbac.yaml delete mode 100644 config/prow/cluster/horologium_service.yaml delete mode 100644 config/prow/cluster/ing_ingress.yaml delete mode 100644 config/prow/cluster/kube-state-metrics_deployment.yaml delete mode 100644 config/prow/cluster/kube-state-metrics_rbac.yaml delete mode 100644 config/prow/cluster/kube-state-metrics_service.yaml delete mode 100644 config/prow/cluster/kubernetes-external-secrets_crd.yaml delete mode 100644 config/prow/cluster/kubernetes-external-secrets_deployment.yaml delete mode 100644 config/prow/cluster/kubernetes-external-secrets_rbac.yaml delete mode 100644 config/prow/cluster/kubernetes-external-secrets_service.yaml delete mode 100644 config/prow/cluster/kubernetes_external_secrets.yaml delete mode 100644 config/prow/cluster/needs-rebase_deployment.yaml delete mode 100644 config/prow/cluster/needs-rebase_service.yaml delete mode 100644 config/prow/cluster/pipeline_deployment.yaml delete mode 100644 config/prow/cluster/pipeline_rbac.yaml delete mode 100644 config/prow/cluster/prow-canary-k8s-io_managedcertificate.yaml delete mode 100644 config/prow/cluster/prow-k8s-io_managedcertificate.yaml delete mode 100644 config/prow/cluster/prow-kubernetes-io_managedcertificate.yaml delete mode 100644 config/prow/cluster/prow_controller_manager_deployment.yaml delete mode 100644 config/prow/cluster/prow_controller_manager_rbac.yaml delete mode 100644 config/prow/cluster/prow_controller_manager_service.yaml delete mode 100644 config/prow/cluster/prowjob-crd/legacy/prowjob-schemaless_customresourcedefinition.yaml delete mode 100644 config/prow/cluster/prowjob-crd/prowjob_customresourcedefinition.yaml delete mode 100644 config/prow/cluster/pushgateway_deployment.yaml delete mode 100644 config/prow/cluster/sinker_deployment.yaml delete mode 100644 config/prow/cluster/sinker_rbac.yaml delete mode 100644 config/prow/cluster/sinker_service.yaml delete mode 100644 config/prow/cluster/starter/starter-azure.yaml delete mode 100644 config/prow/cluster/starter/starter-gcs.yaml delete mode 100644 config/prow/cluster/starter/starter-s3-kind.yaml delete mode 100644 config/prow/cluster/starter/starter-s3.yaml delete mode 100644 config/prow/cluster/statusreconciler_deployment.yaml delete mode 100644 config/prow/cluster/statusreconciler_rbac.yaml delete mode 100644 config/prow/cluster/test-pods_namespace.yaml delete mode 100644 config/prow/cluster/tide_deployment.yaml delete mode 100644 config/prow/cluster/tide_rbac.yaml delete mode 100644 config/prow/cluster/tide_service.yaml delete mode 100644 config/prow/cluster/tls-ing_ingress.yaml delete mode 100644 config/prow/cluster/trusted_serviceaccounts.yaml delete mode 100644 config/prow/experimental/controller_manager.yaml diff --git a/config/clusters/k8s-prow/cluster-configuration.tf b/config/clusters/k8s-prow/cluster-configuration.tf deleted file mode 100644 index befe43f43e21..000000000000 --- a/config/clusters/k8s-prow/cluster-configuration.tf +++ /dev/null @@ -1,129 +0,0 @@ -/* -This file defines the configuration for the `k8s-prow` cluster: - - GCP container cluster - - GCP container node pools -*/ - -variable "project_name" { - type = "string" - default = "k8s-prow" -} - -variable "cluster_name" { - type = "string" - default = "prow" -} - -variable "cluster_region" { - type = "string" - default = "us-central1-f" -} - -# Configure the Google Cloud provider -provider "google" { - project = "${var.project_name}" - region = "${var.cluster_region}" -} - -# Configure the Google Cloud beta provider (required for defining taints) -provider "google-beta" { - project = "${var.project_name}" - region = "${var.cluster_region}" -} - -resource "google_container_cluster" "cluster" { - name = "${var.cluster_name}" - location = "${var.cluster_region}" - - # Whether the ABAC authorizer is enabled for this cluster. When enabled, identities - # in the system, including service accounts, nodes, and controllers, will have statically - # granted permissions beyond those provided by the RBAC configuration or IAM. - # Set to `false` to utilize RBAC. - enable_legacy_abac = true - - # Disable basic and client certificate authorization for the cluster - master_auth { - client_certificate_config { - issue_client_certificate = false - } - } -} - -# The "ghproxy" pool is for running the GitHub reverse proxy cache (i.e. GHproxy) -resource "google_container_node_pool" "ghproxy_nodes" { - provider = "google-beta" - - name = "ghproxy" - location = "${google_container_cluster.cluster.location}" - cluster = "${google_container_cluster.cluster.name}" - node_count = 1 - - - # Auto repair, and auto upgrade nodes to match the master version - management { - auto_repair = true - auto_upgrade = true - } - - # The node configuration of the pool. - node_config { - machine_type = "e2-standard-8" - disk_size_gb = "100" - labels = { - dedicated = "ghproxy" - } - taint { - key = "dedicated" - value = "ghproxy" - effect = "NO_SCHEDULE" - } - oauth_scopes = [ - # Compute Engine (rw) - "https://www.googleapis.com/auth/compute", - # Storage (ro) - "https://www.googleapis.com/auth/devstorage.read_only", - # Service Control (enabled) - "https://www.googleapis.com/auth/servicecontrol", - # Service Management (rw) - "https://www.googleapis.com/auth/service.management", - # Stackdriver Logging (wo) - "https://www.googleapis.com/auth/logging.write", - # Stackdriver Monitoring (full) - "https://www.googleapis.com/auth/monitoring", - ] - } -} - -resource "google_container_node_pool" "e2_standard_8_nodes" { - name = "e2-standard-8" - location = "${google_container_cluster.cluster.location}" - cluster = "${google_container_cluster.cluster.name}" - node_count = 8 - - # Auto repair, and auto upgrade nodes to match the master version - management { - auto_repair = true - auto_upgrade = true - } - - # The node configuration of the pool. - node_config { - machine_type = "e2-standard-8" - disk_size_gb = "200" - - oauth_scopes = [ - # Compute Engine (rw) - "https://www.googleapis.com/auth/compute", - # Storage (ro) - "https://www.googleapis.com/auth/devstorage.read_only", - # Service Control (enabled) - "https://www.googleapis.com/auth/servicecontrol", - # Service Management (rw) - "https://www.googleapis.com/auth/service.management", - # Stackdriver Logging (wo) - "https://www.googleapis.com/auth/logging.write", - # Stackdriver Monitoring (full) - "https://www.googleapis.com/auth/monitoring", - ] - } -} diff --git a/config/prow/Makefile b/config/prow/Makefile deleted file mode 100644 index 8030daaca7ad..000000000000 --- a/config/prow/Makefile +++ /dev/null @@ -1,51 +0,0 @@ -# Copyright 2021 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -include ../../hack/Makefile.gcloud.mk - -# These are the usual GKE variables. -PROJECT ?= k8s-prow -CLUSTER ?= prow -ZONE ?= us-central1-f - -PROJECT_BUILD ?= k8s-prow-builds -CLUSTER_BUILD ?= prow -ZONE_BUILD ?= us-central1-f - -JOB_NAMESPACE ?= test-pods - -update-config: get-cluster-credentials - kubectl create configmap config --from-file=config.yaml=config.yaml --dry-run=client -o yaml | kubectl replace configmap config -f - - -update-plugins: get-cluster-credentials - kubectl create configmap plugins --from-file=plugins.yaml=plugins.yaml --dry-run=client -o yaml | kubectl replace configmap plugins -f - - -deploy-prow: get-cluster-credentials - kubectl apply --server-side=true -f ./cluster/prowjob-crd/prowjob_customresourcedefinition.yaml - kubectl apply -f ./cluster/ - - # Temporary solution for working around the issue of KES being flaky, see - # https://github.com/kubernetes/test-infra/issues/24869#issuecomment-1147530320. - # TODO(chaodaiG): remove this once the above issue is fixed. - kubectl -n default rollout restart deployment kubernetes-external-secrets - -deploy-build: get-build-cluster-credentials - kubectl apply -f ./cluster/build/ - -deploy-all: deploy-prow deploy-build - -.PHONY: update-config update-plugins deploy-prow deploy-build deploy-all - -# The targets below are for breaking glass usages, should not run on a regular -# basis diff --git a/config/prow/cluster/OWNERS b/config/prow/cluster/OWNERS deleted file mode 100644 index 9cbbe453fb0b..000000000000 --- a/config/prow/cluster/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -# See the OWNERS docs at https://go.k8s.io/owners - -# TODO: delete this directory - -labels: -- area/prow/bump diff --git a/config/prow/cluster/build/boskos-resources/boskos-resources.yaml b/config/prow/cluster/build/boskos-resources/boskos-resources.yaml deleted file mode 100644 index 114b772124fe..000000000000 --- a/config/prow/cluster/build/boskos-resources/boskos-resources.yaml +++ /dev/null @@ -1,339 +0,0 @@ -resources: -- names: - - ci-k8s-e2e-gci-tip-gce - - ci-kubernetes-e2e-gke-gpu - - e2e-gce-gci-ci-1-4 - - e2e-gce-gci-ci-1-5 - - e2e-gce-gci-ci-master - - e2e-gce-gci-ci-master-slow - - e2e-gce-gci-ci-serial - - e2e-gce-gci-ci-serial-1-4 - - e2e-gce-gci-ci-serial-1-5 - - e2e-gce-gci-ci-slow-1-4 - - e2e-gce-gci-ci-slow-1-5 - - gce-cvm-upg-1-3-1-4-ctl-skew - - gce-cvm-upg-1-3-lat-ctl-skew - - gce-cvm-upg-1-4-1-3-ctl-skew - - gce-cvm-upg-1-4-1-5-ctl-skew - - gce-cvm-upg-1-4-lat-ctl-skew - - gce-cvm-upg-1-5-1-4-ctl-skew - - gce-cvm-upg-lat-1-3-ctl-skew - - gce-cvm-upg-lat-1-4-ctl-skew - - gce-gci-upg-1-3-1-4-ctl-skew - - gce-gci-upg-1-3-lat-ctl-skew - - gce-gci-upg-1-4-1-3-ctl-skew - - gce-gci-upg-1-4-1-5-ctl-skew - - gce-gci-upg-1-4-lat-ctl-skew - - gce-gci-upg-1-5-1-4-ctl-skew - - gce-gci-upg-lat-1-3-ctl-skew - - gce-gci-upg-lat-1-4-ctl-skew - - gce-up-c1-3-g1-4-up-clu - - gce-up-c1-3-g1-4-up-clu-n - - gce-up-c1-3-g1-4-up-mas - - gce-up-glat-up-etcd - - k8s-boskos-gce-project-01 - - k8s-boskos-gce-project-02 - - k8s-boskos-gce-project-03 - - k8s-boskos-gce-project-04 - - k8s-boskos-gce-project-05 - - k8s-boskos-gce-project-06 - - k8s-boskos-gce-project-07 - - k8s-boskos-gce-project-08 - - k8s-boskos-gce-project-09 - - k8s-boskos-gce-project-10 - - k8s-boskos-gce-project-11 - - k8s-boskos-gce-project-12 - - k8s-boskos-gce-project-13 - - k8s-boskos-gce-project-14 - - k8s-boskos-gce-project-15 - - k8s-boskos-gce-project-16 - - k8s-boskos-gce-project-17 - - k8s-boskos-gce-project-18 - - k8s-boskos-gce-project-19 - - k8s-boskos-gce-project-20 - - k8s-docker-validation-gci - - k8s-e2e-gce-alpha1-5 - - k8s-e2e-gce-scalability - - k8s-e2e-gci-gce-alpha1-5 - - k8s-gce-1-5 - - k8s-gce-cvm-1-5-1-6-ctl-skew - - k8s-gce-cvm-1-6-1-5-ctl-skew - - k8s-gce-cvm-1-6-m-ctl-skw-srl - - k8s-gce-cvm-1-6-mstr-ctl-skew - - k8s-gce-cvm-m-1-6-ctl-skw-srl - - k8s-gce-cvm-mstr-1-6-ctl-skew - - k8s-gce-dg-1-6-1-5-dwngr-clu - - k8s-gce-gci-1-5-1-6-ctl-skew - - k8s-gce-gci-1-6-1-5-ctl-skew - - k8s-gce-gci-1-6-m-ctl-skw-srl - - k8s-gce-gci-1-6-mstr-ctl-skew - - k8s-gce-gci-m-1-6-ctl-skw-srl - - k8s-gce-gci-mstr-1-6-ctl-skew - - k8s-gce-ingress1-5 - - k8s-gce-reboot-1-5 - - k8s-gce-serial-1-5 - - k8s-gce-slow-1-5 - - k8s-gce-upg-1-5-1-6-up-clu - - k8s-gce-upg-1-5-1-6-up-clu-n - - k8s-gce-upg-1-5-1-6-up-mas - - k8s-gci-gce-ingress1-5 - - k8s-gci-gce-reboot-1-5 - - k8s-jenkins-charts - - k8s-jenkins-cvm - - k8s-jenkins-garbagecollector - - k8s-jenkins-gci-kubemark - - k8s-jkns-e2e-bazel - - k8s-jkns-e2e-etcd3 - - k8s-jkns-e2e-gce - - k8s-jkns-e2e-gce-1-6 - - k8s-jkns-e2e-gce-alpha - - k8s-jkns-e2e-gce-alpha1-4 - - k8s-jkns-e2e-gce-ci-reboot - - k8s-jkns-e2e-gce-flaky - - k8s-jkns-e2e-gce-gci - - k8s-jkns-e2e-gce-gci-serial - - k8s-jkns-e2e-gce-gci-slow - - k8s-jkns-e2e-gce-kubenet - - k8s-jkns-e2e-gce-prl-flaky - - k8s-jkns-e2e-gce-reboot-1-2 - - k8s-jkns-e2e-gce-serial-1-2 - - k8s-jkns-e2e-gce-slow - - k8s-jkns-e2e-gce-slow-1-2 - - k8s-jkns-e2e-gce-ubuntu - - k8s-jkns-e2e-gce-ubuntu-serial - - k8s-jkns-e2e-gce-ubuntu-slow - - k8s-jkns-e2e-gci-gce-1-6 - - k8s-jkns-e2e-gci-gce-alpha - - k8s-jkns-e2e-gci-gce-alpha1-4 - - k8s-jkns-e2e-gke-ubuntu - - k8s-jkns-e2e-gke-ubuntu-serial - - k8s-jkns-e2e-gke-ubuntu-slow - - k8s-jkns-e2e-kubeadm-ci-1-6 - - k8s-jkns-e2e-kubeadm-gce-ci - - k8s-jkns-e2e-kubeadm-per-1-6 - - k8s-jkns-e2e-protobuf - - k8s-jkns-e2e-prow-canary - - k8s-jkns-e2e-ubuntu-gce-1-6 - - k8s-jkns-gce-1-3 - - k8s-jkns-gce-1-4 - - k8s-jkns-gce-alpha-1-6 - - k8s-jkns-gce-etcd2-1-6 - - k8s-jkns-gce-ingress1-4 - - k8s-jkns-gce-reboot-1-3 - - k8s-jkns-gce-reboot-1-4 - - k8s-jkns-gce-reboot-1-6 - - k8s-jkns-gce-sd-log - - k8s-jkns-gce-serial-1-3 - - k8s-jkns-gce-serial-1-4 - - k8s-jkns-gce-serial-1-6 - - k8s-jkns-gce-slow-1-3 - - k8s-jkns-gce-slow-1-4 - - k8s-jkns-gce-slow-1-6 - - k8s-jkns-gce-soak-1-2 - - k8s-jkns-gce-soak-1-4 - - k8s-jkns-gce-soak-2 - - k8s-jkns-gce-taintevict - - k8s-jkns-gce-ubuntu-1-6 - - k8s-jkns-gce-ubuntu-1-6-serial - - k8s-jkns-gce-ubuntu-1-6-slow - - k8s-jkns-gce-upgrade - - k8s-jkns-gci-etcd3 - - k8s-jkns-gci-garbage - - k8s-jkns-gci-gce-1-2 - - k8s-jkns-gci-gce-1-3 - - k8s-jkns-gci-gce-alpha - - k8s-jkns-gci-gce-alpha-1-6 - - k8s-jkns-gci-gce-flaky - - k8s-jkns-gci-gce-ingress-1-6 - - k8s-jkns-gci-gce-ingress1-4 - - k8s-jkns-gci-gce-kubenet - - k8s-jkns-gci-gce-multizone - - k8s-jkns-gci-gce-protobuf - - k8s-jkns-gci-gce-reboot - - k8s-jkns-gci-gce-reboot-1-2 - - k8s-jkns-gci-gce-reboot-1-3 - - k8s-jkns-gci-gce-reboot-1-4 - - k8s-jkns-gci-gce-reboot-1-6 - - k8s-jkns-gci-gce-sd-log - - k8s-jkns-gci-gce-serial-1-2 - - k8s-jkns-gci-gce-serial-1-3 - - k8s-jkns-gci-gce-serial-1-6 - - k8s-jkns-gci-gce-slow-1-2 - - k8s-jkns-gci-gce-slow-1-3 - - k8s-jkns-gci-gce-slow-1-6 - - k8s-jkns-gci-gke-reboot-1-4 - - k8s-jkns-gke-reboot-1-4 - - k8s-jkns-gke-slow-1-4 - - k8s-jkns-pr-gci-bld-e2e-gce-fd - - k8s-jkns-pr-kubeadm - - k8s-kubeadm-1-6-on-1-7 - - kube-gce-upg-1-4-1-5-upg-clu - - kube-gce-upg-1-4-1-5-upg-clu-n - - kube-gce-upg-1-4-1-5-upg-mas - - kube-gce-upg-lat-cluster - - kube-gce-upg-lat-master - - kubernetes-es-logging - - kubernetes-gci-es-logging - - kubernetes-gci-flannel - - kubernetes-gci-ingress - - kubernetes-gci-ingress-1-2 - - kubernetes-gci-ingress-1-3 - - kubernetes-gci-petset - - kubernetes-gci-scale - - kubernetes-ingress - - kubernetes-jkns-e2e-gce-serial - - kubernetes-petset - state: dirty - type: gce-project -- names: - - k8s-gke-gpu-boskos-02 - - k8s-gke-gpu-boskos-03 - - k8s-gke-gpu-boskos-04 - - k8s-gke-gpu-boskos-05 - - k8s-gke-gpu-boskos-06 - - k8s-gke-gpu-boskos-07 - - k8s-gke-gpu-boskos-08 - - k8s-gke-gpu-boskos-09 - - k8s-gke-gpu-boskos-10 - - k8s-jkns-e2e-gce-gpus - - k8s-jkns-e2e-gce-gpus-1-7 - - k8s-jkns-e2e-gce-gpus-beta - - k8s-jkns-e2e-gce-plugin-gpus - - k8s-jkns-e2e-gke-gpus - - k8s-jkns-e2e-gke-gpus-1-7 - - k8s-jkns-e2e-gke-gpus-beta - - k8s-jkns-e2e-gke-plugin-gpus - state: dirty - type: gpu-project -- names: - - k8s-ingress-boskos-01 - - k8s-ingress-boskos-02 - - k8s-ingress-boskos-03 - - k8s-ingress-boskos-04 - - k8s-ingress-boskos-05 - - k8s-ingress-boskos-06 - - k8s-ingress-boskos-07 - - k8s-ingress-boskos-08 - - k8s-ingress-boskos-09 - - k8s-ingress-boskos-10 - - k8s-ingress-boskos-11 - - k8s-ingress-boskos-12 - - k8s-ingress-boskos-13 - - k8s-ingress-boskos-14 - - k8s-ingress-boskos-15 - - k8s-ingress-boskos-16 - - k8s-ingress-boskos-17 - - k8s-ingress-boskos-18 - - k8s-ingress-boskos-19 - - k8s-ingress-boskos-20 - state: dirty - type: ingress-project -- names: - - istio-gke-addon-prow-e2e-test - state: dirty - type: istio-project -- names: - - k8s-e2e-gce-scalability-1-1 - - k8s-e2e-gce-scalability-1-2 - - k8s-e2e-gci-gce-scale-1-4 - - k8s-e2e-gci-gce-scale-1-5 - - k8s-jenkins-gci-scalability - - k8s-jenkins-gci-scalability-2 - - k8s-jenkins-kubemark - - k8s-jenkins-scalability-2 - - k8s-jenkins-scalability-3 - - k8s-jenkins-scalability-4 - - k8s-jenkins-scalability-5 - - k8s-periodic-scale-1 - - k8s-periodic-scale-2 - - k8s-periodic-scale-3 - - k8s-periodic-scale-4 - - k8s-periodic-scale-5 - state: dirty - type: scalability-project -- names: - - capa-user-01 - - capa-user-02 - - capa-user-03 - - capa-user-04 - - capa-user-05 - - capa-user-06 - - capa-user-07 - - capa-user-08 - - capa-user-09 - - capa-user-00 - state: dirty - type: aws-account -- names: - - k8s-presubmit-scale-1 - - k8s-presubmit-scale-2 - - k8s-presubmit-scale-3 - - k8s-presubmit-scale-4 - - k8s-presubmit-scale-5 - - k8s-presubmit-scale-6 - - k8s-presubmit-scale-7 - - k8s-presubmit-scale-8 - - k8s-presubmit-scale-9 - - k8s-presubmit-scale-10 - - k8s-presubmit-scale-11 - - k8s-presubmit-scale-12 - - k8s-presubmit-scale-13 - - k8s-presubmit-scale-14 - - k8s-presubmit-scale-15 - - k8s-presubmit-scale-16 - - k8s-presubmit-scale-17 - - k8s-presubmit-scale-18 - - k8s-presubmit-scale-19 - - k8s-presubmit-scale-20 - - k8s-presubmit-scale-21 - - k8s-presubmit-scale-22 - - k8s-presubmit-scale-23 - - k8s-presubmit-scale-24 - - k8s-presubmit-scale-25 - - k8s-presubmit-scale-26 - - k8s-presubmit-scale-27 - - k8s-presubmit-scale-28 - - k8s-presubmit-scale-29 - - k8s-presubmit-scale-30 - - k8s-presubmit-scale-31 - - k8s-presubmit-scale-32 - - k8s-presubmit-scale-33 - - k8s-presubmit-scale-34 - - k8s-presubmit-scale-35 - - k8s-presubmit-scale-36 - - k8s-presubmit-scale-37 - - k8s-presubmit-scale-38 - - k8s-presubmit-scale-39 - - k8s-presubmit-scale-40 - - k8s-presubmit-scale-41 - - k8s-presubmit-scale-42 - - k8s-presubmit-scale-43 - - k8s-presubmit-scale-44 - - k8s-presubmit-scale-45 - state: dirty - type: scalability-presubmit-project -- names: - - k8s-presubmit-scale - state: dirty - type: scalability-presubmit-5k-project -- names: - - k8s-jkns-gke-ubuntu - - k8s-jkns-gke-ubuntu-1-6 - - k8s-jkns-gke-ubuntu-1-6-alpha - - k8s-jkns-gke-ubuntu-1-6-as - - k8s-jkns-gke-ubuntu-1-6-flaky - - k8s-jkns-gke-ubuntu-1-6-ingres - - k8s-jkns-gke-ubuntu-1-6-reboot - - k8s-jkns-gke-ubuntu-1-6-serial - - k8s-jkns-gke-ubuntu-1-6-slow - - k8s-jkns-gke-ubuntu-1-6-updown - - k8s-jkns-gke-ubuntu-alpha - - k8s-jkns-gke-ubuntu-as - - k8s-jkns-gke-ubuntu-flaky - - k8s-jkns-gke-ubuntu-ingress - - k8s-jkns-gke-ubuntu-reboot - - k8s-jkns-gke-ubuntu-serial - - k8s-jkns-gke-ubuntu-slow - - k8s-jkns-gke-ubuntu-updown - state: dirty - type: node-e2e-project diff --git a/config/prow/cluster/build/boskos-resources/boskos_test.go b/config/prow/cluster/build/boskos-resources/boskos_test.go deleted file mode 100644 index 700870d614d0..000000000000 --- a/config/prow/cluster/build/boskos-resources/boskos_test.go +++ /dev/null @@ -1,34 +0,0 @@ -/* -Copyright 2017 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package cluster - -import ( - "testing" - - "k8s.io/test-infra/kubetest/boskos/common" -) - -func TestConfig(t *testing.T) { - config, err := common.ParseConfig("boskos-resources.yaml") - if err != nil { - t.Fatalf("parseConfig error: %v", err) - } - - if err = common.ValidateConfig(config); err != nil { - t.Fatalf("invalid config: %v", err) - } -} diff --git a/config/prow/cluster/build/build_kubernetes-external-secrets_crd.yaml b/config/prow/cluster/build/build_kubernetes-external-secrets_crd.yaml deleted file mode 120000 index 11a52631ff83..000000000000 --- a/config/prow/cluster/build/build_kubernetes-external-secrets_crd.yaml +++ /dev/null @@ -1 +0,0 @@ -../kubernetes-external-secrets_crd.yaml \ No newline at end of file diff --git a/config/prow/cluster/build/build_kubernetes-external-secrets_customresource.yaml b/config/prow/cluster/build/build_kubernetes-external-secrets_customresource.yaml deleted file mode 100644 index 15e8f90d345c..000000000000 --- a/config/prow/cluster/build/build_kubernetes-external-secrets_customresource.yaml +++ /dev/null @@ -1,135 +0,0 @@ -# This is a place holder for adding kubernetes external secrets to the prow build cluster, please add the -# ExternalSecret CR here, separated by `---`. ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: akeyless-test-cred - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: external-344008 - data: - - key: akeyless-test-cred - name: credentials - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: azure-cred - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: kubernetes-upstream - data: - - key: azure-cred - name: credentials - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: azure-capz-sa-cred - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: kubernetes-upstream - data: - - key: azure-capz-sa-cred - name: credentials - version: latest - template: - data: - serviceAccountSigningPub: <%= JSON.parse(data.credentials).serviceAccountSigningPub %> - serviceAccountSigningKey: <%= JSON.parse(data.credentials).serviceAccountSigningKey %> ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: cluster-api-provider-vsphere-ci - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: cluster-api-provider-vsphere - data: - - key: vmc-e2e-vm-ssh_key - name: vmc-e2e-vm-ssh.key - version: latest - - key: vmc-e2e-vm-ssh_pubkey - name: vmc-e2e-vm-ssh.pubkey - version: latest - - key: vmc-vcenter-thumbprint - name: vmc-vcenter-thumbprint - version: latest - - key: vmc-vcenter-url - name: vmc-vcenter-url - version: latest - - key: vmc-vcenter-cluster-api-provider-vsphere-user - name: vmc-vcenter-cluster-api-provider-vsphere-user - version: latest - - key: vmc-vcenter-cluster-api-provider-vsphere-password - name: vmc-vcenter-cluster-api-provider-vsphere-password - version: latest - - key: vmc-vcenter-cloud-provider-vsphere-user - name: vmc-vcenter-cloud-provider-vsphere-user - version: latest - - key: vmc-vcenter-cloud-provider-vsphere-password - name: vmc-vcenter-cloud-provider-vsphere-password - version: latest - - key: vmc-vcenter-image-builder-user - name: vmc-vcenter-image-builder-user - version: latest - - key: vmc-vcenter-image-builder-password - name: vmc-vcenter-image-builder-password - version: latest - - key: vmc-vcenter-janitor-user - name: vmc-vcenter-janitor-user - version: latest - - key: vmc-vcenter-janitor-password - name: vmc-vcenter-janitor-password - version: latest - - key: vmc-vpn-ca_crt - name: vmc-vpn-ca.crt - version: latest - - key: vmc-vpn-client_crt - name: vmc-vpn-client.crt - version: latest - - key: vmc-vpn-client_key - name: vmc-vpn-client.key - version: latest - - key: vmc-vpn-config_ovpn - name: vmc-vpn-config.ovpn - version: latest - - key: vmc-vpn-tls_key - name: vmc-vpn-tls.key - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: nfd-creds - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: node-feature-discovery - data: - - key: codecovToken - name: codecov-token - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: cloud-provider-vsphere-ci - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: cloud-provider-vsphere - data: - - key: GCR_KEY_FILE - name: keyfile.json - version: latest - - key: CONFIG_ENV - name: config.env - version: latest diff --git a/config/prow/cluster/build/build_kubernetes-external-secrets_deployment.yaml b/config/prow/cluster/build/build_kubernetes-external-secrets_deployment.yaml deleted file mode 120000 index 1f8c38e033a4..000000000000 --- a/config/prow/cluster/build/build_kubernetes-external-secrets_deployment.yaml +++ /dev/null @@ -1 +0,0 @@ -../kubernetes-external-secrets_deployment.yaml \ No newline at end of file diff --git a/config/prow/cluster/build/build_kubernetes-external-secrets_rbac.yaml b/config/prow/cluster/build/build_kubernetes-external-secrets_rbac.yaml deleted file mode 120000 index efc73b8d5d74..000000000000 --- a/config/prow/cluster/build/build_kubernetes-external-secrets_rbac.yaml +++ /dev/null @@ -1 +0,0 @@ -../kubernetes-external-secrets_rbac.yaml \ No newline at end of file diff --git a/config/prow/cluster/build/build_kubernetes-external-secrets_service.yaml b/config/prow/cluster/build/build_kubernetes-external-secrets_service.yaml deleted file mode 120000 index 525691230ebe..000000000000 --- a/config/prow/cluster/build/build_kubernetes-external-secrets_service.yaml +++ /dev/null @@ -1 +0,0 @@ -../kubernetes-external-secrets_service.yaml \ No newline at end of file diff --git a/config/prow/cluster/build/build_kubernetes_external_secrets.yaml b/config/prow/cluster/build/build_kubernetes_external_secrets.yaml deleted file mode 100644 index f895196fd804..000000000000 --- a/config/prow/cluster/build/build_kubernetes_external_secrets.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# This is a place holder for adding kubernetes external secrets, please add the -# ExternalSecret CR here, separated by `---`. ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: service-account - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: k8s-prow-builds - data: - - key: default-k8s-build-cluster-service-account-key - name: service-account.json - version: latest diff --git a/config/prow/cluster/build/build_serviceaccounts.yaml b/config/prow/cluster/build/build_serviceaccounts.yaml deleted file mode 100644 index f5900dd3ab97..000000000000 --- a/config/prow/cluster/build/build_serviceaccounts.yaml +++ /dev/null @@ -1,85 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by container image promotor audit jobs - # TODO(fejta): better define these rules and enforce them in presubmit. - iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-gcr-audit-test-prod.iam.gserviceaccount.com - name: k8s-gcr-audit-test-prod - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by container image promotor backup test job (pull-k8sio-backup) - iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-gcr-backup-test-prod-bak.iam.gserviceaccount.com - name: k8s-infra-gcr-promoter-test - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by container image promoter vulnerability scanning presubmit check (pull-k8sio-cip-vuln) - iam.gke.io/gcp-service-account: k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com - name: k8s-infra-gcr-vuln-scanning - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Default prowjob runner for default build cluster. This service account - # doesn't have GCP permission other than writing artifacts into the default - # GCS artifacts location for prow. - # Please creating separate service account for special needs. - iam.gke.io/gcp-service-account: prowjob-default-sa@k8s-prow-builds.iam.gserviceaccount.com - name: prowjob-default-sa - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by Kops testing jobs - iam.gke.io/gcp-service-account: pr-kubekins@kubernetes-jenkins-pull.iam.gserviceaccount.com - name: k8s-kops-test - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: kubernetes-external-secrets-sa@k8s-prow-builds.iam.gserviceaccount.com - name: kubernetes-external-secrets-sa - namespace: default ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by the gcp provider tests for secrets-store-csi-driver - iam.gke.io/gcp-service-account: k8s-csi-test@secretmanager-csi-build.iam.gserviceaccount.com - name: secrets-store-csi-driver-gcp - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # Used by the metrics-kettle job. (Note that for some reason this job uses the triage SA not the kettle SA.) - iam.gke.io/gcp-service-account: triage@k8s-gubernator.iam.gserviceaccount.com - name: triage - namespace: test-pods ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # TODO(mpherman): Clean this up once done testing clusterfuzzlite integration - # Used by the test-infra-fuzz job. - iam.gke.io/gcp-service-account: test-fuzz-sa@colew-test.iam.gserviceaccount.com - name: fuzz-test - namespace: test-pods diff --git a/config/prow/cluster/build/cpu-limit-range_limitrange.yaml b/config/prow/cluster/build/cpu-limit-range_limitrange.yaml deleted file mode 100644 index fca86dc25d83..000000000000 --- a/config/prow/cluster/build/cpu-limit-range_limitrange.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: LimitRange -metadata: - name: cpu-limit-range - namespace: test-pods -spec: - limits: - - defaultRequest: - cpu: 250m - type: Container diff --git a/config/prow/cluster/build/create-loop-devs_daemonset.yaml b/config/prow/cluster/build/create-loop-devs_daemonset.yaml deleted file mode 100644 index b3ba8b597030..000000000000 --- a/config/prow/cluster/build/create-loop-devs_daemonset.yaml +++ /dev/null @@ -1,58 +0,0 @@ -# A daemonset to create /dev/loopX device nodes before they are -# needed. -# -# Normally, new nodes are created dynamically by the kernel. But nodes -# in a KIND cluster are started with a copy of /dev from the host and -# loop devices created later on do not show up in that static /dev -# (https://github.com/kubernetes-sigs/kind/issues/1248). Creating -# "enough" (1000 in this daemonset) in advance avoids running out of -# loop devices. -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: create-loop-devs - namespace: kube-system - labels: - app: create-loop-devs -spec: - selector: - matchLabels: - name: create-loop-devs - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: "10%" - template: - metadata: - labels: - name: create-loop-devs - spec: - tolerations: - - operator: Exists - effect: NoSchedule - containers: - - name: loopdev - command: - - sh - - -c - - | - while true; do - for i in $(seq 0 1000); do - if ! [ -e /dev/loop$i ]; then - mknod /dev/loop$i b 7 $i - fi - done - sleep 100000000 - done - image: alpine:20240606 - imagePullPolicy: IfNotPresent - resources: {} - securityContext: - privileged: true - volumeMounts: - - name: dev - mountPath: /dev - volumes: - - name: dev - hostPath: - path: /dev diff --git a/config/prow/cluster/build/grandmatriarch.yaml b/config/prow/cluster/build/grandmatriarch.yaml deleted file mode 100644 index 77ca66c217a8..000000000000 --- a/config/prow/cluster/build/grandmatriarch.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - # TODO(fejta): consider a better project, but this is what service-account uses now - iam.gke.io/gcp-service-account: pr-kubekins@kubernetes-jenkins-pull.iam.gserviceaccount.com - name: grandmatriarch - namespace: test-pods ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: grandmatriarch - namespace: test-pods -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - get - - update ---- - -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: grandmatriarch - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: grandmatriarch -subjects: -- kind: ServiceAccount - name: grandmatriarch ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: grandmatriarch - namespace: test-pods - labels: - app: grandmatriarch -spec: - replicas: 0 - selector: - matchLabels: - app: grandmatriarch - template: - metadata: - labels: - app: grandmatriarch - spec: - serviceAccountName: grandmatriarch - containers: - - name: bakery - image: us-docker.pkg.dev/k8s-infra-prow/images/grandmatriarch:v20240802-66b115076 - args: - - http-cookiefile diff --git a/config/prow/cluster/build/mem-limit-range_limitrange.yaml b/config/prow/cluster/build/mem-limit-range_limitrange.yaml deleted file mode 100644 index cb65f9a022f4..000000000000 --- a/config/prow/cluster/build/mem-limit-range_limitrange.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: LimitRange -metadata: - name: mem-limit-range - namespace: test-pods -spec: - limits: - - defaultRequest: - memory: 1Gi - type: Container diff --git a/config/prow/cluster/build/test-pods_namespace.yaml b/config/prow/cluster/build/test-pods_namespace.yaml deleted file mode 100644 index eff8a8612f0b..000000000000 --- a/config/prow/cluster/build/test-pods_namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods diff --git a/config/prow/cluster/build/tune-sysctls_daemonset.yaml b/config/prow/cluster/build/tune-sysctls_daemonset.yaml deleted file mode 100644 index 9aa0348f9ffb..000000000000 --- a/config/prow/cluster/build/tune-sysctls_daemonset.yaml +++ /dev/null @@ -1,50 +0,0 @@ -# a simple daemonset to tune sysctls -# intended to be used in a prow build cluster -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: tune-sysctls - namespace: kube-system - labels: - app: tune-sysctls -spec: - selector: - matchLabels: - name: tune-sysctls - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: "10%" - template: - metadata: - labels: - name: tune-sysctls - spec: - hostNetwork: true - hostPID: true - hostIPC: true - tolerations: - - operator: Exists - effect: NoSchedule - containers: - - name: setsysctls - command: - - sh - - -c - - | - while true; do - sysctl -w fs.inotify.max_user_watches=524288 - sleep 10 - done - image: alpine:20240606 - imagePullPolicy: IfNotPresent - resources: {} - securityContext: - privileged: true - volumeMounts: - - name: sys - mountPath: /sys - volumes: - - name: sys - hostPath: - path: /sys diff --git a/config/prow/cluster/cherrypicker_deployment.yaml b/config/prow/cluster/cherrypicker_deployment.yaml deleted file mode 100644 index 24d1f653f67d..000000000000 --- a/config/prow/cluster/cherrypicker_deployment.yaml +++ /dev/null @@ -1,69 +0,0 @@ -# Copyright 2021 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: cherrypicker - labels: - app: cherrypicker -spec: - replicas: 0 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: cherrypicker - template: - metadata: - labels: - app: cherrypicker - spec: - serviceAccountName: "" - serviceAccount: "" - terminationGracePeriodSeconds: 180 - containers: - - name: cherrypicker - image: us-docker.pkg.dev/k8s-infra-prow/images/cherrypicker:v20240802-66b115076 - imagePullPolicy: Always - args: - - --github-token-path=/etc/github/token - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --dry-run=false - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: tmp - mountPath: /tmp - volumes: - - name: tmp - emptyDir: {} - - name: hmac - secret: - secretName: hmac-token - - name: github-token - secret: - secretName: k8s-infra-cherrypick-robot-github-token diff --git a/config/prow/cluster/cherrypicker_service.yaml b/config/prow/cluster/cherrypicker_service.yaml deleted file mode 100644 index 0618a9cb6cff..000000000000 --- a/config/prow/cluster/cherrypicker_service.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# Copyright 2021 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - name: cherrypicker - namespace: default -spec: - selector: - app: cherrypicker - ports: - - port: 80 - targetPort: 8888 - type: ClusterIP diff --git a/config/prow/cluster/crier_deployment.yaml b/config/prow/cluster/crier_deployment.yaml deleted file mode 100644 index 987b93682dc8..000000000000 --- a/config/prow/cluster/crier_deployment.yaml +++ /dev/null @@ -1,142 +0,0 @@ -# Copyright 2019 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: crier - labels: - app: crier -spec: - replicas: 0 - selector: - matchLabels: - app: crier - template: - metadata: - labels: - app: crier - spec: - serviceAccountName: crier - terminationGracePeriodSeconds: 30 - containers: - - name: crier - image: us-docker.pkg.dev/k8s-infra-prow/images/crier:v20240802-66b115076 - args: - - --blob-storage-workers=1 - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-token-path=/etc/github/oauth - - --github-workers=5 - - --job-config-path=/etc/job-config - - --kubernetes-blob-storage-workers=1 - - --slack-token-file=/etc/slack/token - - --slack-workers=1 - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config:/etc/kubeconfig-build-test-infra-trusted/kubeconfig:/etc/kubeconfig-build-k8s-prow-builds/kubeconfig:/etc/kubeconfig-build-rules-k8s/kubeconfig:/etc/kubeconfig-eks-prow-build-cluster/kubeconfig:/etc/kubeconfig-k8s-infra-kops-prow-build/kubeconfig" - # AWS_ variables needed to assume role to access the prow-build-cluster EKS cluster. - - name: AWS_ROLE_ARN - value: arn:aws:iam::468814281478:role/Prow-EKS-Admin - - name: AWS_WEB_IDENTITY_TOKEN_FILE - value: /var/run/secrets/aws-iam-token/serviceaccount/token - - name: AWS_REGION - value: us-east-2 - ports: - - name: metrics - containerPort: 9090 - volumeMounts: - - mountPath: /etc/kubeconfig - name: kubeconfig - readOnly: true - - mountPath: /etc/kubeconfig-build-test-infra-trusted - name: kubeconfig-build-test-infra-trusted - readOnly: true - - mountPath: /etc/kubeconfig-build-k8s-prow-builds - name: kubeconfig-build-k8s-prow-builds - readOnly: true - - mountPath: /etc/kubeconfig-build-rules-k8s - name: kubeconfig-build-rules-k8s - readOnly: true - - mountPath: /etc/kubeconfig-eks-prow-build-cluster - name: kubeconfig-eks-prow-build-cluster - readOnly: true - - mountPath: /etc/kubeconfig-k8s-infra-kops-prow-build - name: kubeconfig-k8s-infra-kops-prow-build - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: oauth - mountPath: /etc/github - readOnly: true - - name: slack - mountPath: /etc/slack - readOnly: true - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - mountPath: /var/run/secrets/aws-iam-token/serviceaccount - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - - name: oauth - secret: - secretName: oauth-token - - name: slack - secret: - secretName: slack-token - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: kubeconfig-build-test-infra-trusted - secret: - defaultMode: 420 - secretName: kubeconfig-build-test-infra-trusted - - name: kubeconfig-build-k8s-prow-builds - secret: - defaultMode: 420 - secretName: kubeconfig-build-k8s-prow-builds - - name: kubeconfig-build-rules-k8s - secret: - defaultMode: 420 - secretName: kubeconfig-build-rules-k8s - - name: kubeconfig-eks-prow-build-cluster - secret: - defaultMode: 420 - secretName: kubeconfig-eks-prow-build-cluster - - name: kubeconfig-k8s-infra-kops-prow-build - secret: - defaultMode: 420 - secretName: kubeconfig-k8s-infra-kops-prow-build - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: sts.amazonaws.com - expirationSeconds: 86400 - path: token diff --git a/config/prow/cluster/crier_rbac.yaml b/config/prow/cluster/crier_rbac.yaml deleted file mode 100644 index 53f4471080a6..000000000000 --- a/config/prow/cluster/crier_rbac.yaml +++ /dev/null @@ -1,87 +0,0 @@ -# Copyright 2019 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: control-plane@k8s-prow.iam.gserviceaccount.com - name: crier - namespace: default ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: crier -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - "prowjobs" - verbs: - - "get" - - "watch" - - "list" - - "patch" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: crier -rules: -- apiGroups: - - "" - resources: - - "pods" - - "events" - verbs: - - "get" - - "list" -- apiGroups: - - "" - resources: - - "pods" - verbs: - - "patch" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier-namespaced - namespace: default -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: default ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier-namespaced - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: default diff --git a/config/prow/cluster/crier_service.yaml b/config/prow/cluster/crier_service.yaml deleted file mode 100644 index 908e588bb8b3..000000000000 --- a/config/prow/cluster/crier_service.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app: crier - namespace: default - name: crier -spec: - ports: - - name: metrics - port: 9090 - protocol: TCP - selector: - app: crier diff --git a/config/prow/cluster/deck_deployment.yaml b/config/prow/cluster/deck_deployment.yaml deleted file mode 100644 index 0eb58afc1e01..000000000000 --- a/config/prow/cluster/deck_deployment.yaml +++ /dev/null @@ -1,179 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: deck - labels: - app: deck -spec: - replicas: 3 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: deck - template: - metadata: - labels: - app: deck - spec: - serviceAccountName: deck - terminationGracePeriodSeconds: 30 - containers: - - name: deck - image: us-docker.pkg.dev/k8s-infra-prow/images/deck:v20240802-66b115076 - imagePullPolicy: Always - ports: - - name: http - containerPort: 8080 - - name: metrics - containerPort: 9090 - args: - - --tide-url=http://tide/ - - --hook-url=http://hook:8888/plugin-help - - --redirect-http-to=prow.k8s.io - - --oauth-url=/github-login - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - - --spyglass=true - - --rerun-creates-job - - --github-token-path=/etc/github/oauth - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-oauth-config-file=/etc/githuboauth/secret - - --cookie-secret=/etc/cookie/secret - - --plugin-config=/etc/plugins/plugins.yaml - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config:/etc/kubeconfig-build-test-infra-trusted/kubeconfig:/etc/kubeconfig-build-k8s-prow-builds/kubeconfig:/etc/kubeconfig-build-rules-k8s/kubeconfig:/etc/kubeconfig-eks-prow-build-cluster/kubeconfig::/etc/kubeconfig-k8s-infra-kops-prow-build/kubeconfig" - # AWS_ variables needed to assume role to access the prow-build-cluster EKS cluster. - - name: AWS_ROLE_ARN - value: arn:aws:iam::468814281478:role/Prow-EKS-Admin - - name: AWS_WEB_IDENTITY_TOKEN_FILE - value: /var/run/secrets/aws-iam-token/serviceaccount/token - - name: AWS_REGION - value: us-east-2 - volumeMounts: - - name: oauth-config - mountPath: /etc/githuboauth - readOnly: true - - name: cookie-secret - mountPath: /etc/cookie - readOnly: true - - mountPath: /etc/kubeconfig - name: kubeconfig - readOnly: true - - mountPath: /etc/kubeconfig-build-test-infra-trusted - name: kubeconfig-build-test-infra-trusted - readOnly: true - - mountPath: /etc/kubeconfig-build-k8s-prow-builds - name: kubeconfig-build-k8s-prow-builds - readOnly: true - - mountPath: /etc/kubeconfig-build-rules-k8s - name: kubeconfig-build-rules-k8s - readOnly: true - - mountPath: /etc/kubeconfig-eks-prow-build-cluster - name: kubeconfig-eks-prow-build-cluster - readOnly: true - - mountPath: /etc/kubeconfig-k8s-infra-kops-prow-build - name: kubeconfig-k8s-infra-kops-prow-build - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: oauth-token - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - mountPath: /var/run/secrets/aws-iam-token/serviceaccount - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: oauth-config - secret: - secretName: github-oauth-config - - name: oauth-token - secret: - secretName: oauth-token - - name: cookie-secret - secret: - secretName: cookie - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: kubeconfig-build-test-infra-trusted - secret: - defaultMode: 420 - secretName: kubeconfig-build-test-infra-trusted - - name: kubeconfig-build-k8s-prow-builds - secret: - defaultMode: 420 - secretName: kubeconfig-build-k8s-prow-builds - - name: kubeconfig-build-rules-k8s - secret: - defaultMode: 420 - secretName: kubeconfig-build-rules-k8s - - name: kubeconfig-eks-prow-build-cluster - secret: - defaultMode: 420 - secretName: kubeconfig-eks-prow-build-cluster - - name: kubeconfig-k8s-infra-kops-prow-build - secret: - defaultMode: 420 - secretName: kubeconfig-k8s-infra-kops-prow-build - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - - name: plugins - configMap: - name: plugins - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: sts.amazonaws.com - expirationSeconds: 86400 - path: token diff --git a/config/prow/cluster/deck_rbac.yaml b/config/prow/cluster/deck_rbac.yaml deleted file mode 100644 index 500d79d8dd80..000000000000 --- a/config/prow/cluster/deck_rbac.yaml +++ /dev/null @@ -1,66 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - annotations: - iam.gke.io/gcp-service-account: control-plane@k8s-prow.iam.gserviceaccount.com - name: deck ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: deck -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - # Required when deck runs with `--rerun-creates-job=true` - - create - # Required to abort jobs - - patch ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: deck -rules: -- apiGroups: - - "" - resources: - - pods/log - verbs: - - get ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: deck -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: deck -subjects: -- kind: ServiceAccount - name: deck ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: deck -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: deck -subjects: -- kind: ServiceAccount - name: deck - namespace: default diff --git a/config/prow/cluster/deck_service.yaml b/config/prow/cluster/deck_service.yaml deleted file mode 100644 index e65a50ebcb96..000000000000 --- a/config/prow/cluster/deck_service.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - labels: - app: deck - namespace: default - name: deck -spec: - selector: - app: deck - ports: - - name: main - port: 80 - targetPort: 8080 - protocol: TCP - - name: metrics - port: 9090 - protocol: TCP - type: NodePort diff --git a/config/prow/cluster/gce-ssd-retain_storageclass.yaml b/config/prow/cluster/gce-ssd-retain_storageclass.yaml deleted file mode 100644 index 1a6759b7c6c9..000000000000 --- a/config/prow/cluster/gce-ssd-retain_storageclass.yaml +++ /dev/null @@ -1,25 +0,0 @@ -# Copyright 2018 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# The 'gce-ssd-retain' storage class provisions a pd-ssd from GCE and -# specifies the 'Retain' reclaim policy. -kind: StorageClass -apiVersion: storage.k8s.io/v1 -metadata: - namespace: default - name: gce-ssd-retain -provisioner: kubernetes.io/gce-pd -parameters: - type: pd-ssd -reclaimPolicy: Retain diff --git a/config/prow/cluster/ghproxy.yaml b/config/prow/cluster/ghproxy.yaml deleted file mode 100644 index cdf4abb70de4..000000000000 --- a/config/prow/cluster/ghproxy.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# Copyright 2018 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - namespace: default - labels: - app: ghproxy - name: ghproxy -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 100Gi - # gce-ssd-retain is specified in config/prow/cluster/gce-ssd-retain_storageclass.yaml - # - # If you are setting up your own Prow instance you can do any of the following: - # 1) Delete this to use the default storage class for your cluster. - # 2) Specify your own storage class. - # 3) If you are using GKE you can use the gce-ssd-retain storage class. It can be - # created with: `kubectl create -f config/prow/cluster/gce-ssd-retain_storageclass.yaml - storageClassName: gce-ssd-retain ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: ghproxy - labels: - app: ghproxy -spec: - selector: - matchLabels: - app: ghproxy - replicas: 0 # TODO(fejta): this should be HA - template: - metadata: - labels: - app: ghproxy - spec: - containers: - - name: ghproxy - image: us-docker.pkg.dev/k8s-infra-prow/images/ghproxy:v20240802-66b115076 - args: - - --cache-dir=/cache - - --cache-sizeGB=99 - - --push-gateway=pushgateway - - --serve-metrics=true - ports: - - name: main - containerPort: 8888 - - name: metrics - containerPort: 9090 - volumeMounts: - - name: cache - mountPath: /cache - volumes: - - name: cache - persistentVolumeClaim: - claimName: ghproxy - # run on our dedicated node - tolerations: - - key: "dedicated" - operator: "Equal" - value: "ghproxy" - effect: "NoSchedule" - nodeSelector: - dedicated: "ghproxy" ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: ghproxy - namespace: default - name: ghproxy -spec: - ports: - - name: main - port: 80 - protocol: TCP - targetPort: 8888 - - name: metrics - port: 9090 - selector: - app: ghproxy - type: ClusterIP diff --git a/config/prow/cluster/halogen.yaml b/config/prow/cluster/halogen.yaml deleted file mode 100644 index 302049b58305..000000000000 --- a/config/prow/cluster/halogen.yaml +++ /dev/null @@ -1,65 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: halogen - namespace: default - labels: - app: halogen -spec: - replicas: 0 - selector: - matchLabels: - app: halogen - template: - metadata: - labels: - app: halogen - spec: - terminationGracePeriodSeconds: 30 - serviceAccountName: halogen - containers: - - name: halogen - image: gcr.io/k8s-staging-test-infra/analyze:v20240801-a5d9345e59 - args: - - --project=k8s-prow - - --region=us-central1 - - --model=TCN3936569386298507264 - - --port=8888 - ports: - - name: http - containerPort: 8888 - # name: metrics - # containerPort: 9090 - readinessProbe: - httpGet: - path: /healthz - port: 8888 - initialDelaySeconds: 5 ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - iam.gke.io/gcp-service-account: control-plane@k8s-prow.iam.gserviceaccount.com - namespace: default - name: halogen ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: halogen - namespace: default - name: halogen -spec: - selector: - app: halogen - ports: - - name: main - port: 80 - targetPort: 8888 - protocol: TCP - # name: metrics - # port: 9090 - # protocol: TCP - type: NodePort diff --git a/config/prow/cluster/hook_deployment.yaml b/config/prow/cluster/hook_deployment.yaml deleted file mode 100644 index f7a31cce5b8c..000000000000 --- a/config/prow/cluster/hook_deployment.yaml +++ /dev/null @@ -1,183 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: hook - labels: - app: hook -spec: - replicas: 0 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: hook - template: - metadata: - labels: - app: hook - spec: - serviceAccountName: hook - terminationGracePeriodSeconds: 180 - containers: - - name: hook - image: us-docker.pkg.dev/k8s-infra-prow/images/hook:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --slack-token-file=/etc/slack/token - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-token-path=/etc/github/oauth - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config:/etc/kubeconfig-build-test-infra-trusted/kubeconfig:/etc/kubeconfig-build-k8s-prow-builds/kubeconfig:/etc/kubeconfig-build-rules-k8s/kubeconfig:/etc/kubeconfig-eks-prow-build-cluster/kubeconfig::/etc/kubeconfig-k8s-infra-kops-prow-build/kubeconfig" - # AWS_ variables needed to assume role to access the prow-build-cluster EKS cluster. - - name: AWS_ROLE_ARN - value: arn:aws:iam::468814281478:role/Prow-EKS-Admin - - name: AWS_WEB_IDENTITY_TOKEN_FILE - value: /var/run/secrets/aws-iam-token/serviceaccount/token - - name: AWS_REGION - value: us-east-2 - ports: - - name: http - containerPort: 8888 - - name: metrics - containerPort: 9090 - volumeMounts: - - name: slack - mountPath: /etc/slack - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: oauth - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: cat-api - mountPath: /etc/cat-api - readOnly: true - - name: unsplash-api - mountPath: /etc/unsplash-api - readOnly: true - - name: kubeconfig - mountPath: /etc/kubeconfig - readOnly: true - - mountPath: /etc/kubeconfig-build-test-infra-trusted - name: kubeconfig-build-test-infra-trusted - readOnly: true - - mountPath: /etc/kubeconfig-build-k8s-prow-builds - name: kubeconfig-build-k8s-prow-builds - readOnly: true - - mountPath: /etc/kubeconfig-build-rules-k8s - name: kubeconfig-build-rules-k8s - readOnly: true - - mountPath: /etc/kubeconfig-eks-prow-build-cluster - name: kubeconfig-eks-prow-build-cluster - readOnly: true - - mountPath: /etc/kubeconfig-k8s-infra-kops-prow-build - name: kubeconfig-k8s-infra-kops-prow-build - readOnly: true - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - mountPath: /var/run/secrets/aws-iam-token/serviceaccount - name: aws-iam-token - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: slack - secret: - secretName: slack-token - - name: hmac - secret: - secretName: hmac-token - - name: oauth - secret: - secretName: oauth-token - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - - name: plugins - configMap: - name: plugins - - name: cat-api - configMap: - name: cat-api-key - - name: unsplash-api - secret: - secretName: unsplash-api-key - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: kubeconfig-build-test-infra-trusted - secret: - defaultMode: 420 - secretName: kubeconfig-build-test-infra-trusted - - name: kubeconfig-build-k8s-prow-builds - secret: - defaultMode: 420 - secretName: kubeconfig-build-k8s-prow-builds - - name: kubeconfig-build-rules-k8s - secret: - defaultMode: 420 - secretName: kubeconfig-build-rules-k8s - - name: kubeconfig-eks-prow-build-cluster - secret: - defaultMode: 420 - secretName: kubeconfig-eks-prow-build-cluster - - name: kubeconfig-k8s-infra-kops-prow-build - secret: - defaultMode: 420 - secretName: kubeconfig-k8s-infra-kops-prow-build - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: sts.amazonaws.com - expirationSeconds: 86400 - path: token diff --git a/config/prow/cluster/hook_rbac.yaml b/config/prow/cluster/hook_rbac.yaml deleted file mode 100644 index 81a9e28df19a..000000000000 --- a/config/prow/cluster/hook_rbac.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: "hook" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "hook" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - get - - list - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "hook" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "hook" -subjects: -- kind: ServiceAccount - name: "hook" diff --git a/config/prow/cluster/hook_service.yaml b/config/prow/cluster/hook_service.yaml deleted file mode 100644 index f83355a9a733..000000000000 --- a/config/prow/cluster/hook_service.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - labels: - app: hook - namespace: default - name: hook -spec: - selector: - app: hook - ports: - - name: main - port: 8888 - protocol: TCP - - name: metrics - port: 9090 - protocol: TCP - type: NodePort diff --git a/config/prow/cluster/horologium_deployment.yaml b/config/prow/cluster/horologium_deployment.yaml deleted file mode 100644 index 9a2f73d17456..000000000000 --- a/config/prow/cluster/horologium_deployment.yaml +++ /dev/null @@ -1,59 +0,0 @@ -# Copyright 2017 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: horologium - labels: - app: horologium -spec: - replicas: 0 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: horologium - template: - metadata: - labels: - app: horologium - spec: - serviceAccountName: horologium - terminationGracePeriodSeconds: 30 - containers: - - name: horologium - image: us-docker.pkg.dev/k8s-infra-prow/images/horologium:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - - --dry-run=false - ports: - - name: metrics - containerPort: 9090 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config diff --git a/config/prow/cluster/horologium_rbac.yaml b/config/prow/cluster/horologium_rbac.yaml deleted file mode 100644 index 27c3ce22284a..000000000000 --- a/config/prow/cluster/horologium_rbac.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: "horologium" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "horologium" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "horologium" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "horologium" -subjects: -- kind: ServiceAccount - name: "horologium" diff --git a/config/prow/cluster/horologium_service.yaml b/config/prow/cluster/horologium_service.yaml deleted file mode 100644 index 3bc66b9e8667..000000000000 --- a/config/prow/cluster/horologium_service.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app: horologium - namespace: default - name: horologium -spec: - ports: - - name: metrics - port: 9090 - protocol: TCP - selector: - app: horologium diff --git a/config/prow/cluster/ing_ingress.yaml b/config/prow/cluster/ing_ingress.yaml deleted file mode 100644 index ebf2ee630d8b..000000000000 --- a/config/prow/cluster/ing_ingress.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: default - name: ing - annotations: - kubernetes.io/ingress.global-static-ip-name: prow-managed-certs - kubernetes.io/ingress.class: "gce" - networking.gke.io/managed-certificates: prow-canary-k8s-io -spec: - rules: - - host: prow-canary.k8s.io - http: - paths: - - path: /* - pathType: ImplementationSpecific - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: ImplementationSpecific - backend: - service: - name: hook - port: - number: 8888 - - path: /metrics - pathType: ImplementationSpecific - backend: - service: - name: pushgateway-external - port: - number: 80 diff --git a/config/prow/cluster/kube-state-metrics_deployment.yaml b/config/prow/cluster/kube-state-metrics_deployment.yaml deleted file mode 100644 index 11de8237c231..000000000000 --- a/config/prow/cluster/kube-state-metrics_deployment.yaml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - name: kube-state-metrics - namespace: kube-system -spec: - replicas: 0 - selector: - matchLabels: - app.kubernetes.io/name: kube-state-metrics - template: - metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - spec: - containers: - - image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.0 - args: - - --metric-allowlist="kube_pod_container_status_restarts_total" - livenessProbe: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 5 - timeoutSeconds: 5 - name: kube-state-metrics - ports: - - containerPort: 8080 - name: http-metrics - - containerPort: 8081 - name: telemetry - readinessProbe: - httpGet: - path: / - port: 8081 - initialDelaySeconds: 5 - timeoutSeconds: 5 - securityContext: - runAsUser: 65534 - # nodeSelector: - # kubernetes.io/os: linux - serviceAccountName: kube-state-metrics diff --git a/config/prow/cluster/kube-state-metrics_rbac.yaml b/config/prow/cluster/kube-state-metrics_rbac.yaml deleted file mode 100644 index 1cd5391e81c3..000000000000 --- a/config/prow/cluster/kube-state-metrics_rbac.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - name: kube-state-metrics - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - name: kube-state-metrics -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kube-state-metrics -subjects: -- kind: ServiceAccount - name: kube-state-metrics - namespace: kube-system ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - name: kube-state-metrics -rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - list - - watch diff --git a/config/prow/cluster/kube-state-metrics_service.yaml b/config/prow/cluster/kube-state-metrics_service.yaml deleted file mode 100644 index 96f4b9dba8ce..000000000000 --- a/config/prow/cluster/kube-state-metrics_service.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app.kubernetes.io/name: kube-state-metrics - app.kubernetes.io/version: 2.10.0 - name: kube-state-metrics - namespace: kube-system -spec: - clusterIP: None - ports: - - name: http-metrics - port: 8080 - targetPort: http-metrics - - name: telemetry - port: 8081 - targetPort: telemetry - selector: - app.kubernetes.io/name: kube-state-metrics diff --git a/config/prow/cluster/kubernetes-external-secrets_crd.yaml b/config/prow/cluster/kubernetes-external-secrets_crd.yaml deleted file mode 100644 index 10c35e85c9c3..000000000000 --- a/config/prow/cluster/kubernetes-external-secrets_crd.yaml +++ /dev/null @@ -1,236 +0,0 @@ ---- -# From https://github.com/external-secrets/kubernetes-external-secrets/blob/master/charts/kubernetes-external-secrets/crds/kubernetes-client.io_externalsecrets_crd.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: externalsecrets.kubernetes-client.io - annotations: - # used in e2e testing - app.kubernetes.io/managed-by: helm -spec: - group: kubernetes-client.io - scope: Namespaced - - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - required: - - spec - type: object - properties: - spec: - type: object - properties: - controllerId: - description: The ID of controller instance that manages this ExternalSecret. - This is needed in case there is more than a KES controller instances within the cluster. - type: string - type: - type: string - description: >- - DEPRECATED: Use spec.template.type - template: - description: Template which will be deep merged without mutating - any existing fields. into generated secret, can be used to - set for example annotations or type on the generated secret - type: object - x-kubernetes-preserve-unknown-fields: true - backendType: - description: >- - Determines which backend to use for fetching secrets - type: string - enum: - - secretsManager - - systemManager - - vault - - azureKeyVault - - gcpSecretsManager - - alicloudSecretsManager - - ibmcloudSecretsManager - - akeyless - vaultRole: - description: >- - Used by: vault - type: string - vaultMountPoint: - description: >- - Used by: vault - type: string - kvVersion: - description: Vault K/V version either 1 or 2, default = 2 - type: integer - minimum: 1 - maximum: 2 - keyVaultName: - description: >- - Used by: azureKeyVault - type: string - dataFrom: - type: array - items: - type: string - dataFromWithOptions: - type: array - items: - type: object - properties: - key: - description: Secret key in backend - type: string - isBinary: - description: >- - Whether the backend secret shall be treated as binary data - represented by a base64-encoded string. You must set this to true - for any base64-encoded binary data in the backend - to ensure it - is not encoded in base64 again. Default is false. - type: boolean - versionStage: - description: >- - Used by: alicloudSecretsManager, secretsManager - type: string - versionId: - description: >- - Used by: secretsManager - type: string - required: - - key - data: - type: array - items: - type: object - properties: - key: - description: Secret key in backend - type: string - name: - description: Name set for this key in the generated secret - type: string - property: - description: Property to extract if secret in backend is a JSON object - type: string - isBinary: - description: >- - Whether the backend secret shall be treated as binary data - represented by a base64-encoded string. You must set this to true - for any base64-encoded binary data in the backend - to ensure it - is not encoded in base64 again. Default is false. - type: boolean - path: - description: >- - Path from SSM to scrape secrets - This will fetch all secrets and use the key from the secret as variable name - type: string - recursive: - description: Allow to recurse thru all child keys on a given path, default false - type: boolean - secretType: - description: >- - Used by: ibmcloudSecretsManager - Type of secret - one of username_password, iam_credentials or arbitrary - type: string - version: - description: >- - Used by: gcpSecretsManager - type: string - x-kubernetes-int-or-string: true - versionStage: - description: >- - Used by: alicloudSecretsManager, secretsManager - type: string - versionId: - description: >- - Used by: secretsManager - type: string - oneOf: - - required: - - key - - name - - required: - - path - roleArn: - type: string - description: >- - Used by: alicloudSecretsManager, secretsManager, systemManager - region: - type: string - description: >- - Used by: secretsManager, systemManager - projectId: - type: string - description: >- - Used by: gcpSecretsManager - keyByName: - type: boolean - description: >- - Whether to interpret the key as a secret name (if true) or ID (the default). - Used by: ibmcloudSecretsManager - oneOf: - - properties: - backendType: - enum: - - secretsManager - - systemManager - - properties: - backendType: - enum: - - vault - - properties: - backendType: - enum: - - azureKeyVault - required: - - keyVaultName - - properties: - backendType: - enum: - - gcpSecretsManager - - properties: - backendType: - enum: - - alicloudSecretsManager - - properties: - backendType: - enum: - - ibmcloudSecretsManager - - properties: - backendType: - enum: - - akeyless - anyOf: - - required: - - data - - required: - - dataFrom - - required: - - dataFromWithOptions - status: - type: object - properties: - lastSync: - type: string - status: - type: string - observedGeneration: - type: number - additionalPrinterColumns: - - jsonPath: .status.lastSync - name: Last Sync - type: date - - jsonPath: .status.status - name: status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - names: - shortNames: - - es - kind: ExternalSecret - plural: externalsecrets - singular: externalsecret diff --git a/config/prow/cluster/kubernetes-external-secrets_deployment.yaml b/config/prow/cluster/kubernetes-external-secrets_deployment.yaml deleted file mode 100644 index b92ad2a70d94..000000000000 --- a/config/prow/cluster/kubernetes-external-secrets_deployment.yaml +++ /dev/null @@ -1,41 +0,0 @@ ---- -# Source: kubernetes-external-secrets/templates/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: kubernetes-external-secrets - namespace: "default" - labels: - app.kubernetes.io/name: kubernetes-external-secrets -spec: - replicas: 0 - selector: - matchLabels: - app.kubernetes.io/name: kubernetes-external-secrets - template: - metadata: - labels: - app.kubernetes.io/name: kubernetes-external-secrets - spec: - serviceAccountName: kubernetes-external-secrets-sa - containers: - - name: kubernetes-external-secrets - image: "ghcr.io/external-secrets/kubernetes-external-secrets:8.5.1" - ports: - - name: prometheus - containerPort: 3001 - imagePullPolicy: IfNotPresent - resources: - {} - env: - - name: "LOG_LEVEL" - value: "info" - - name: "METRICS_PORT" - value: "3001" - - name: "POLLER_INTERVAL_MILLISECONDS" - value: "10000" - - name: "WATCH_TIMEOUT" - value: "60000" - # Params for env vars populated from k8s secrets - securityContext: - runAsNonRoot: true diff --git a/config/prow/cluster/kubernetes-external-secrets_rbac.yaml b/config/prow/cluster/kubernetes-external-secrets_rbac.yaml deleted file mode 100644 index 9350715db4ae..000000000000 --- a/config/prow/cluster/kubernetes-external-secrets_rbac.yaml +++ /dev/null @@ -1,57 +0,0 @@ ---- -# Source: kubernetes-external-secrets/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: kubernetes-external-secrets - labels: - app.kubernetes.io/name: kubernetes-external-secrets -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["create", "update", "get"] - - apiGroups: [""] - resources: ["namespaces"] - verbs: ["get", "watch", "list"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - resourceNames: ["externalsecrets.kubernetes-client.io"] - verbs: ["get", "update"] - - apiGroups: ["kubernetes-client.io"] - resources: ["externalsecrets"] - verbs: ["get", "watch", "list"] - - apiGroups: ["kubernetes-client.io"] - resources: ["externalsecrets/status"] - verbs: ["get", "update"] ---- -# Source: kubernetes-external-secrets/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-external-secrets - labels: - app.kubernetes.io/name: kubernetes-external-secrets -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubernetes-external-secrets -subjects: - - name: kubernetes-external-secrets-sa - namespace: "default" - kind: ServiceAccount ---- -# Source: kubernetes-external-secrets/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-external-secrets-auth - labels: - app.kubernetes.io/name: kubernetes-external-secrets -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:auth-delegator -subjects: -- name: kubernetes-external-secrets-sa - namespace: "default" - kind: ServiceAccount diff --git a/config/prow/cluster/kubernetes-external-secrets_service.yaml b/config/prow/cluster/kubernetes-external-secrets_service.yaml deleted file mode 100644 index adcd019ec7c5..000000000000 --- a/config/prow/cluster/kubernetes-external-secrets_service.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -# Source: kubernetes-external-secrets/templates/service.yaml -apiVersion: v1 -kind: Service -metadata: - name: kubernetes-external-secrets - namespace: "default" - labels: - app.kubernetes.io/name: kubernetes-external-secrets -spec: - selector: - app.kubernetes.io/name: kubernetes-external-secrets - ports: - - protocol: TCP - port: 3001 - name: prometheus - targetPort: prometheus diff --git a/config/prow/cluster/kubernetes_external_secrets.yaml b/config/prow/cluster/kubernetes_external_secrets.yaml deleted file mode 100644 index 9a63c3f1d2ec..000000000000 --- a/config/prow/cluster/kubernetes_external_secrets.yaml +++ /dev/null @@ -1,158 +0,0 @@ -# This is a place holder for adding kubernetes external secrets, please add the -# ExternalSecret CR here, separated by `---`. ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: service-account - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: k8s-prow-builds - data: - - key: default-k8s-build-cluster-service-account-key - name: service-account.json - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: prometheus-alert-slack-post-prow-alerts-secret-url - namespace: prow-monitoring -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: prometheus-alert-slack-post-prow-alerts-secret-url - name: url - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: prometheus-alert-slack-post-testing-ops-secret-url - namespace: prow-monitoring -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: prometheus-alert-slack-post-testing-ops-secret-url - name: url - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: grafana - namespace: prow-monitoring -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: gke_k8s-prow_us-central1-f_prow__prow-monitoring__grafana - name: password - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: k8s-infra-cherrypick-robot-github-token # The name of the K8s Secret - namespace: default -spec: - backendType: gcpSecretsManager - projectId: kubernetes-public - data: - - key: k8s-infra-cherrypick-robot-github-token # The name of the GSM Secret - name: token # The key to write in the K8s Secret - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-prow-services - namespace: test-pods -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: gke_k8s-prow_us-central1-f_prow__default__prow-services - name: config - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-build-test-infra-trusted - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: prow_build_cluster_kubeconfig_test-infra-trusted - name: kubeconfig - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-build-k8s-prow-builds - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: gke_k8s-prow-builds_us-central1-f_prow__default__build-k8s-prow-builds - name: kubeconfig - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-build-rules-k8s - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-prow - data: - - key: gke_rules-k8s_us-central1-f_testing__default__build-rules-k8s - name: kubeconfig - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: cluster-api-provider-digitalocean-quayio - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-infra-prow-build-trusted - data: - - key: capdo-quayio-registry-secret - name: config.json - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-eks-prow-build-cluster - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-infra-prow-build-trusted - data: - - key: eks-prow-build-cluster-kubeconfig - name: kubeconfig - version: latest ---- -apiVersion: kubernetes-client.io/v1 -kind: ExternalSecret -metadata: - name: kubeconfig-k8s-infra-kops-prow-build - namespace: default -spec: - backendType: gcpSecretsManager - projectId: k8s-infra-prow-build-trusted - data: - - key: k8s-infra-kops-prow-build-kubeconfig - name: kubeconfig - version: latest diff --git a/config/prow/cluster/needs-rebase_deployment.yaml b/config/prow/cluster/needs-rebase_deployment.yaml deleted file mode 100644 index 27cc8f0918e4..000000000000 --- a/config/prow/cluster/needs-rebase_deployment.yaml +++ /dev/null @@ -1,65 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: needs-rebase - labels: - app: needs-rebase -spec: - replicas: 0 - selector: - matchLabels: - app: needs-rebase - template: - metadata: - labels: - app: needs-rebase - spec: - terminationGracePeriodSeconds: 180 - containers: - - name: needs-rebase - image: us-docker.pkg.dev/k8s-infra-prow/images/needs-rebase:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-token-path=/etc/github/oauth - - --update-period=6h - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: oauth - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - volumes: - - name: hmac - secret: - secretName: hmac-token - - name: oauth - secret: - secretName: oauth-token - - name: plugins - configMap: - name: plugins diff --git a/config/prow/cluster/needs-rebase_service.yaml b/config/prow/cluster/needs-rebase_service.yaml deleted file mode 100644 index 5ea6fb5fd6c2..000000000000 --- a/config/prow/cluster/needs-rebase_service.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# Copyright 2018 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - namespace: default - name: needs-rebase -spec: - selector: - app: needs-rebase - ports: - - port: 80 - targetPort: 8888 - type: NodePort diff --git a/config/prow/cluster/pipeline_deployment.yaml b/config/prow/cluster/pipeline_deployment.yaml deleted file mode 100644 index c88d17fc58b7..000000000000 --- a/config/prow/cluster/pipeline_deployment.yaml +++ /dev/null @@ -1,43 +0,0 @@ -kind: Deployment -apiVersion: apps/v1 -metadata: - name: prow-pipeline - namespace: default -spec: - replicas: 0 - strategy: - type: Recreate - selector: - matchLabels: - app: prow-pipeline - template: - metadata: - labels: - app: prow-pipeline - spec: - serviceAccountName: prow-pipeline - containers: - - name: pipeline - image: us-docker.pkg.dev/k8s-infra-prow/images/pipeline:v20240802-66b115076 - args: - - --all-contexts - - --config=/etc/prow-config/config.yaml - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config" - volumeMounts: - - mountPath: /etc/kubeconfig - name: kubeconfig - readOnly: true - - mountPath: /etc/prow-config - name: prow-config - readOnly: true - volumes: - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: prow-config - configMap: - name: config diff --git a/config/prow/cluster/pipeline_rbac.yaml b/config/prow/cluster/pipeline_rbac.yaml deleted file mode 100644 index 41805a7d6087..000000000000 --- a/config/prow/cluster/pipeline_rbac.yaml +++ /dev/null @@ -1,50 +0,0 @@ -kind: ServiceAccount -apiVersion: v1 -metadata: - name: prow-pipeline - namespace: default - ---- - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: prow-pipeline -rules: -- apiGroups: - - tekton.dev - resources: - - pipelineruns - - pipelineresources - verbs: - - create - - delete - - get - - list - - update - - watch -- apiGroups: - - prow.k8s.io - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - ---- - -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: prow-pipeline -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: prow-pipeline -subjects: -- kind: ServiceAccount - name: prow-pipeline - namespace: default diff --git a/config/prow/cluster/prow-canary-k8s-io_managedcertificate.yaml b/config/prow/cluster/prow-canary-k8s-io_managedcertificate.yaml deleted file mode 100644 index de560f5e68b6..000000000000 --- a/config/prow/cluster/prow-canary-k8s-io_managedcertificate.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: networking.gke.io/v1beta1 -kind: ManagedCertificate -metadata: - name: prow-canary-k8s-io -spec: - domains: - - prow-canary.k8s.io diff --git a/config/prow/cluster/prow-k8s-io_managedcertificate.yaml b/config/prow/cluster/prow-k8s-io_managedcertificate.yaml deleted file mode 100644 index f3804b5de463..000000000000 --- a/config/prow/cluster/prow-k8s-io_managedcertificate.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: networking.gke.io/v1beta1 -kind: ManagedCertificate -metadata: - name: prow-k8s-io -spec: - domains: - - prow.k8s.io diff --git a/config/prow/cluster/prow-kubernetes-io_managedcertificate.yaml b/config/prow/cluster/prow-kubernetes-io_managedcertificate.yaml deleted file mode 100644 index c70351a6e1e6..000000000000 --- a/config/prow/cluster/prow-kubernetes-io_managedcertificate.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: networking.gke.io/v1beta1 -kind: ManagedCertificate -metadata: - name: prow-kubernetes-io -spec: - domains: - - prow.kubernetes.io diff --git a/config/prow/cluster/prow_controller_manager_deployment.yaml b/config/prow/cluster/prow_controller_manager_deployment.yaml deleted file mode 100644 index c5601bc242df..000000000000 --- a/config/prow/cluster/prow_controller_manager_deployment.yaml +++ /dev/null @@ -1,142 +0,0 @@ -# Copyright 2020 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - # Mutually exclusive with plank. Only one of them may have more than zero replicas. - replicas: 0 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - revisionHistoryLimit: 2 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --dry-run=false - - --enable-controller=plank - - --job-config-path=/etc/job-config - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config:/etc/kubeconfig-build-test-infra-trusted/kubeconfig:/etc/kubeconfig-build-k8s-prow-builds/kubeconfig:/etc/kubeconfig-build-rules-k8s/kubeconfig:/etc/kubeconfig-eks-prow-build-cluster/kubeconfig::/etc/kubeconfig-k8s-infra-kops-prow-build/kubeconfig" - # AWS_ variables needed to assume role to access the prow-build-cluster EKS cluster. - - name: AWS_ROLE_ARN - value: arn:aws:iam::468814281478:role/Prow-EKS-Admin - - name: AWS_WEB_IDENTITY_TOKEN_FILE - value: /var/run/secrets/aws-iam-token/serviceaccount/token - - name: AWS_REGION - value: us-east-2 - ports: - - name: metrics - containerPort: 9090 - volumeMounts: - - mountPath: /etc/kubeconfig - name: kubeconfig - readOnly: true - - mountPath: /etc/kubeconfig-build-test-infra-trusted - name: kubeconfig-build-test-infra-trusted - readOnly: true - - mountPath: /etc/kubeconfig-build-k8s-prow-builds - name: kubeconfig-build-k8s-prow-builds - readOnly: true - - mountPath: /etc/kubeconfig-build-rules-k8s - name: kubeconfig-build-rules-k8s - readOnly: true - - mountPath: /etc/kubeconfig-eks-prow-build-cluster - name: kubeconfig-eks-prow-build-cluster - readOnly: true - - mountPath: /etc/kubeconfig-k8s-infra-kops-prow-build - name: kubeconfig-k8s-infra-kops-prow-build - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - mountPath: /var/run/secrets/aws-iam-token/serviceaccount - readOnly: true - livenessProbe: # Pod is killed if this fails 3 times. - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 5 - readinessProbe: # Pod is not considered ready (for rolling deploy and request routing) if this fails 3 times. - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - volumes: - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: kubeconfig-build-test-infra-trusted - secret: - defaultMode: 420 - secretName: kubeconfig-build-test-infra-trusted - - name: kubeconfig-build-k8s-prow-builds - secret: - defaultMode: 420 - secretName: kubeconfig-build-k8s-prow-builds - - name: kubeconfig-build-rules-k8s - secret: - defaultMode: 420 - secretName: kubeconfig-build-rules-k8s - - name: kubeconfig-eks-prow-build-cluster - secret: - defaultMode: 420 - secretName: kubeconfig-eks-prow-build-cluster - - name: kubeconfig-k8s-infra-kops-prow-build - secret: - defaultMode: 420 - secretName: kubeconfig-k8s-infra-kops-prow-build - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: sts.amazonaws.com - expirationSeconds: 86400 - path: token diff --git a/config/prow/cluster/prow_controller_manager_rbac.yaml b/config/prow/cluster/prow_controller_manager_rbac.yaml deleted file mode 100644 index 63e4f5ad56fc..000000000000 --- a/config/prow/cluster/prow_controller_manager_rbac.yaml +++ /dev/null @@ -1,112 +0,0 @@ -# Copyright 2020 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: "prow-controller-manager" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "prow-controller-manager" -rules: -- apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create -- apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create -- apiGroups: - - prow.k8s.io - resources: - - prowjobs - verbs: - - get - - update - - list - - watch - - patch ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "prow-controller-manager" -rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "prow-controller-manager" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "prow-controller-manager" -subjects: -- kind: ServiceAccount - name: "prow-controller-manager" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "prow-controller-manager" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "prow-controller-manager" -subjects: -- kind: ServiceAccount - name: "prow-controller-manager" - namespace: default diff --git a/config/prow/cluster/prow_controller_manager_service.yaml b/config/prow/cluster/prow_controller_manager_service.yaml deleted file mode 100644 index 58b861e39d73..000000000000 --- a/config/prow/cluster/prow_controller_manager_service.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2020 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - labels: - app: prow-controller-manager - namespace: default - name: prow-controller-manager -spec: - ports: - - name: metrics - port: 9090 - protocol: TCP - selector: - app: prow-controller-manager diff --git a/config/prow/cluster/prowjob-crd/legacy/prowjob-schemaless_customresourcedefinition.yaml b/config/prow/cluster/prowjob-crd/legacy/prowjob-schemaless_customresourcedefinition.yaml deleted file mode 100644 index eeaffe42a570..000000000000 --- a/config/prow/cluster/prowjob-crd/legacy/prowjob-schemaless_customresourcedefinition.yaml +++ /dev/null @@ -1,96 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: prowjobs.prow.k8s.io - annotations: - "api-approved.kubernetes.io": "https://github.com/kubernetes/test-infra/pull/8669" -spec: - group: prow.k8s.io - names: - kind: ProwJob - singular: prowjob - plural: prowjobs - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - schema: - openAPIV3Schema: - type: object - properties: - spec: - type: object - x-kubernetes-preserve-unknown-fields: true - properties: - max_concurrency: - type: integer - minimum: 0 - type: - type: string - enum: - - "presubmit" - - "postsubmit" - - "periodic" - - "batch" - status: - type: object - x-kubernetes-preserve-unknown-fields: true - properties: - state: - type: string - enum: - - "scheduling" - - "triggered" - - "pending" - - "success" - - "failure" - - "aborted" - - "error" - anyOf: - - not: - properties: - state: - enum: - - "success" - - "failure" - - "error" - - required: - - completionTime - additionalPrinterColumns: - - name: Job - type: string - description: The name of the job being run. - jsonPath: .spec.job - - name: BuildId - type: string - description: The ID of the job being run. - jsonPath: .status.build_id - - name: Type - type: string - description: The type of job being run. - jsonPath: .spec.type - - name: Org - type: string - description: The org for which the job is running. - jsonPath: .spec.refs.org - - name: Repo - type: string - description: The repo for which the job is running. - jsonPath: .spec.refs.repo - - name: Pulls - type: string - description: The pulls for which the job is running. - jsonPath: ".spec.refs.pulls[*].number" - - name: StartTime - type: date - description: When the job started running. - jsonPath: .status.startTime - - name: CompletionTime - type: date - description: When the job finished running. - jsonPath: .status.completionTime - - name: State - description: The state of the job. - type: string - jsonPath: .status.state diff --git a/config/prow/cluster/prowjob-crd/prowjob_customresourcedefinition.yaml b/config/prow/cluster/prowjob-crd/prowjob_customresourcedefinition.yaml deleted file mode 100644 index 2c26068edec6..000000000000 --- a/config/prow/cluster/prowjob-crd/prowjob_customresourcedefinition.yaml +++ /dev/null @@ -1,52786 +0,0 @@ ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - api-approved.kubernetes.io: https://github.com/kubernetes/test-infra/pull/8669 - controller-gen.kubebuilder.io/version: v0.6.3-0.20210827222652-7b3a8699fa04 - creationTimestamp: null - name: prowjobs.prow.k8s.io -spec: - preserveUnknownFields: false - group: prow.k8s.io - names: - kind: ProwJob - listKind: ProwJobList - plural: prowjobs - singular: prowjob - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: The name of the job being run - jsonPath: .spec.job - name: Job - type: string - - description: The ID of the job being run. - jsonPath: .status.build_id - name: BuildId - type: string - - description: The type of job being run. - jsonPath: .spec.type - name: Type - type: string - - description: The org for which the job is running. - jsonPath: .spec.refs.org - name: Org - type: string - - description: The repo for which the job is running. - jsonPath: .spec.refs.repo - name: Repo - type: string - - description: The pulls for which the job is running. - jsonPath: .spec.refs.pulls[*].number - name: Pulls - type: string - - description: When the job started running. - jsonPath: .status.startTime - name: StartTime - type: date - - description: When the job finished running. - jsonPath: .status.completionTime - name: CompletionTime - type: date - - description: The state of the job. - jsonPath: .status.state - name: State - type: string - name: v1 - schema: - openAPIV3Schema: - description: ProwJob contains the spec as well as runtime metadata. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: "ProwJobSpec configures the details of the prow job. \n Details - include the podspec, code to clone, the cluster it runs any child jobs, - concurrency limitations, etc." - properties: - agent: - description: Agent determines which controller fulfills this specific - ProwJobSpec and runs the job - type: string - cluster: - description: Cluster is which Kubernetes cluster is used to run the - job, only applicable for that specific agent - type: string - context: - description: Context is the name of the status context used to report - back to GitHub - type: string - decoration_config: - description: DecorationConfig holds configuration options for decorating - PodSpecs that users provide - properties: - blobless_fetch: - description: BloblessFetch tells Prow to avoid fetching objects - when cloning using the --filter=blob:none flag. - type: boolean - censor_secrets: - description: CensorSecrets enables censoring output logs and artifacts. - type: boolean - censoring_options: - description: CensoringOptions exposes options for censoring output - logs and artifacts. - properties: - censoring_buffer_size: - description: CensoringBufferSize is the size in bytes of the - buffer allocated for every file being censored. We want - to keep as little of the file in memory as possible in order - for censoring to be reasonably performant in space. However, - to guarantee that we censor every instance of every secret, - our buffer size must be at least two times larger than the - largest secret we are about to censor. While that size is - the smallest possible buffer we could use, if the secrets - being censored are small, censoring will not be performant - as the number of I/O actions per file would increase. If - unset, defaults to 10MiB. - type: integer - censoring_concurrency: - description: CensoringConcurrency is the maximum number of - goroutines that should be censoring artifacts and logs at - any time. If unset, defaults to 10. - format: int64 - type: integer - exclude_directories: - description: ExcludeDirectories are directories which should - not have their content censored. If present, content in - these directories will not be censored even if the directory - also matches a glob in IncludeDirectories. Entries in this - list are relative to $ARTIFACTS, and are parsed with the - go-zglob library, allowing for globbed matches. - items: - type: string - type: array - include_directories: - description: IncludeDirectories are directories which should - have their content censored. If present, only content in - these directories will be censored. Entries in this list - are relative to $ARTIFACTS and are parsed with the go-zglob - library, allowing for globbed matches. - items: - type: string - type: array - type: object - cookiefile_secret: - description: CookieFileSecret is the name of a kubernetes secret - that contains a git http.cookiefile, which should be used during - the cloning process. - type: string - default_memory_request: - anyOf: - - type: integer - - type: string - description: DefaultMemoryRequest is the default requested memory - on a test container. If SetLimitEqualsMemoryRequest is also - true then the Limit will also be set the same as this request. - Could be overridden by memory request defined explicitly on - prowjob. - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - default_service_account_name: - description: DefaultServiceAccountName is the name of the Kubernetes - service account that should be used by the pod if one is not - specified in the podspec. - type: string - fs_group: - description: FsGroup defines special supplemental group ID used - in all containers in a Pod. This allows to change the ownership - of particular volumes by kubelet. This field will not override - the existing ProwJob's PodSecurityContext. Equivalent to PodSecurityContext's - FsGroup - format: int64 - type: integer - gcs_configuration: - description: GCSConfiguration holds options for pushing logs and - artifacts to GCS from a job. - properties: - bucket: - description: 'Bucket is the bucket to upload to, it can be: - * a GCS bucket: with gs:// prefix * a S3 bucket: with s3:// - prefix * a GCS bucket: without a prefix (deprecated, it''s - discouraged to use Bucket without prefix please add the - gs:// prefix)' - type: string - compress_file_types: - description: 'CompressFileTypes specify file types that should - be gzipped prior to upload. Matching files will be compressed - prior to upload, and the content-encoding on these files - will be set to gzip. GCS will transcode these gzipped files - transparently when viewing. See: https://cloud.google.com/storage/docs/transcoding - Example: "txt", "json" Use "*" for all' - items: - type: string - type: array - default_org: - description: DefaultOrg is omitted from GCS paths when using - the legacy or simple strategy - type: string - default_repo: - description: DefaultRepo is omitted from GCS paths when using - the legacy or simple strategy - type: string - job_url_prefix: - description: JobURLPrefix holds the baseURL under which the - jobs output can be viewed. If unset, this will be derived - based on org/repo from the job_url_prefix_config. - type: string - local_output_dir: - description: LocalOutputDir specifies a directory where files - should be copied INSTEAD of uploading to blob storage. This - option is useful for testing jobs that use the pod-utilities - without actually uploading. - type: string - mediaTypes: - additionalProperties: - type: string - description: 'MediaTypes holds additional extension media - types to add to Go''s builtin''s and the local system''s - defaults. This maps extensions to media types, for example: - MediaTypes["log"] = "text/plain"' - type: object - path_prefix: - description: PathPrefix is an optional path that follows the - bucket name and comes before any structure - type: string - path_strategy: - description: PathStrategy dictates how the org and repo are - used when calculating the full path to an artifact in GCS - type: string - type: object - gcs_credentials_secret: - description: GCSCredentialsSecret is the name of the Kubernetes - secret that holds GCS push credentials. - type: string - github_api_endpoints: - description: GitHubAPIEndpoints are the endpoints of GitHub APIs. - items: - type: string - type: array - github_app_id: - description: GitHubAppID is the ID of GitHub App, which is going - to be used for fetching a private repository. - type: string - github_app_private_key_secret: - description: GitHubAppPrivateKeySecret is a Kubernetes secret - that contains the GitHub App private key, which is going to - be used for fetching a private repository. - properties: - key: - description: Key is the key of the corresponding kubernetes - secret that holds the value of the GitHub App private key. - type: string - name: - description: Name is the name of a kubernetes secret. - type: string - type: object - grace_period: - description: GracePeriod is how long the pod utilities will wait - after sending SIGINT to send SIGKILL when aborting a job. Only - applicable if decorating the PodSpec. - type: string - oauth_token_secret: - description: OauthTokenSecret is a Kubernetes secret that contains - the OAuth token, which is going to be used for fetching a private - repository. - properties: - key: - description: Key is the key of the corresponding kubernetes - secret that holds the value of the OAuth token. - type: string - name: - description: Name is the name of a kubernetes secret. - type: string - type: object - pod_pending_timeout: - description: PodPendingTimeout defines how long the controller - will wait to perform garbage collection on pending pods. Specific - for OrgRepo or Cluster. If not set, it has a fallback inside - plank field. - type: string - pod_running_timeout: - description: PodRunningTimeout defines how long the controller - will wait to abort a prowjob pod stuck in running state. Specific - for OrgRepo or Cluster. If not set, it has a fallback inside - plank field. - type: string - pod_unscheduled_timeout: - description: PodUnscheduledTimeout defines how long the controller - will wait to abort a prowjob stuck in an unscheduled state. - Specific for OrgRepo or Cluster. If not set, it has a fallback - inside plank field. - type: string - resources: - description: Resources holds resource requests and limits for - utility containers used to decorate a PodSpec. - properties: - clonerefs: - description: ResourceRequirements describes the compute resource - requirements. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of - compute resources required. If Requests is omitted for - a container, it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - initupload: - description: ResourceRequirements describes the compute resource - requirements. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of - compute resources required. If Requests is omitted for - a container, it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - place_entrypoint: - description: ResourceRequirements describes the compute resource - requirements. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of - compute resources required. If Requests is omitted for - a container, it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - sidecar: - description: ResourceRequirements describes the compute resource - requirements. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of compute - resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount of - compute resources required. If Requests is omitted for - a container, it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - type: object - run_as_group: - description: RunAsGroup defines GID of process in all containers - running in a Pod. This field will not override the existing - ProwJob's PodSecurityContext. Equivalent to PodSecurityContext's - RunAsGroup - format: int64 - type: integer - run_as_user: - description: RunAsUser defines UID for process in all containers - running in a Pod. This field will not override the existing - ProwJob's PodSecurityContext. Equivalent to PodSecurityContext's - RunAsUser - format: int64 - type: integer - s3_credentials_secret: - description: S3CredentialsSecret is the name of the Kubernetes - secret that holds blob storage push credentials. - type: string - set_limit_equals_memory_request: - description: SetLimitEqualsMemoryRequest sets memory limit equal - to request. - type: boolean - skip_cloning: - description: SkipCloning determines if we should clone source - code in the initcontainers for jobs that specify refs - type: boolean - ssh_host_fingerprints: - description: SSHHostFingerprints are the fingerprints of known - SSH hosts that the cloning process can trust. Create with ssh-keyscan - [-t rsa] host - items: - type: string - type: array - ssh_key_secrets: - description: SSHKeySecrets are the names of Kubernetes secrets - that contain SSK keys which should be used during the cloning - process. - items: - type: string - type: array - timeout: - description: Timeout is how long the pod utilities will wait before - aborting a job with SIGINT. - type: string - upload_ignores_interrupts: - description: UploadIgnoresInterrupts causes sidecar to ignore - interrupts for the upload process in hope that the test process - exits cleanly before starting an upload. - type: boolean - utility_images: - description: UtilityImages holds pull specs for utility container - images used to decorate a PodSpec. - properties: - clonerefs: - description: CloneRefs is the pull spec used for the clonerefs - utility - type: string - entrypoint: - description: Entrypoint is the pull spec used for the entrypoint - utility - type: string - initupload: - description: InitUpload is the pull spec used for the initupload - utility - type: string - sidecar: - description: sidecar is the pull spec used for the sidecar - utility - type: string - type: object - type: object - error_on_eviction: - description: ErrorOnEviction indicates that the ProwJob should be - completed and given the ErrorState status if the pod that is executing - the job is evicted. If this field is unspecified or false, a new - pod will be created to replace the evicted one. - type: boolean - extra_refs: - description: ExtraRefs are auxiliary repositories that need to be - cloned, determined from config - items: - description: Refs describes how the repo was constructed. - properties: - base_link: - description: BaseLink is a link to the commit identified by - BaseSHA. - type: string - base_ref: - type: string - base_sha: - type: string - blobless_fetch: - description: BloblessFetch tells prow to avoid fetching objects - when cloning using the --filter=blob:none flag. If unspecified, - defaults to DecorationConfig.BloblessFetch. - type: boolean - clone_depth: - description: CloneDepth is the depth of the clone that will - be used. A depth of zero will do a full clone. - type: integer - clone_uri: - description: CloneURI is the URI that is used to clone the repository. - If unset, will default to `https://github.com/org/repo.git`. - type: string - org: - description: Org is something like kubernetes or k8s.io - type: string - path_alias: - description: PathAlias is the location under /src - where this repository is cloned. If this is not set, /src/github.com/org/repo - will be used as the default. - type: string - pulls: - items: - description: Pull describes a pull request at a particular - point in time. - properties: - author: - type: string - author_link: - description: AuthorLink links to the author of the pull - request. - type: string - commit_link: - description: CommitLink links to the commit identified - by the SHA. - type: string - head_ref: - description: 'HeadRef is the git ref (branch name) of - the proposed change. This can be more human-readable - than just a PR #, and some tools want this metadata - to help associate the work with a pull request (e.g. - some code scanning services, or chromatic.com).' - type: string - link: - description: Link links to the pull request itself. - type: string - number: - type: integer - ref: - description: 'Ref is git ref can be checked out for a - change for example, github: pull/123/head gerrit: refs/changes/00/123/1' - type: string - sha: - type: string - title: - type: string - required: - - author - - number - - sha - type: object - type: array - repo: - description: Repo is something like test-infra - type: string - repo_link: - description: RepoLink links to the source for Repo. - type: string - skip_fetch_head: - description: SkipFetchHead tells prow to avoid a git fetch - call. Multiheaded repos may need to not make this call. The - git fetch call occurs regardless. - type: boolean - skip_submodules: - description: SkipSubmodules determines if submodules should - be cloned when the job is run. Defaults to false. - type: boolean - workdir: - description: WorkDir defines if the location of the cloned repository - will be used as the default working directory. - type: boolean - required: - - org - - repo - type: object - type: array - hidden: - description: Hidden specifies if the Job is considered hidden. Hidden - jobs are only shown by deck instances that have the `--hiddenOnly=true` - or `--show-hidden=true` flag set. Presubmits and Postsubmits can - also be set to hidden by adding their repository in Decks `hidden_repo` - setting. - type: boolean - jenkins_spec: - description: JenkinsSpec holds configuration specific to Jenkins jobs - properties: - github_branch_source_job: - type: boolean - type: object - job: - description: Job is the name of the job - type: string - job_queue_name: - description: JobQueueName is an optional field with name of a queue - defining max concurrency. When several jobs from the same queue - try to run at the same time, the number of them that is actually - started is limited by JobQueueCapacities (part of Plank's config). - If this field is left undefined inifinite concurrency is assumed. - This behaviour may be superseded by MaxConcurrency field, if it - is set to a constraining value. - type: string - max_concurrency: - description: MaxConcurrency restricts the total number of instances - of this job that can run in parallel at once. This is a separate - mechanism to JobQueueName and the lowest max concurrency is selected - from these two. - minimum: 0 - type: integer - namespace: - description: Namespace defines where to create pods/resources. - type: string - pipeline_run_spec: - description: PipelineRunSpec provides the basis for running the test - as a pipeline-crd resource https://github.com/tektoncd/pipeline - properties: - params: - description: Params is a list of parameter names and values. - items: - description: Param declares an ParamValues to use for the parameter - called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold a single - string or string array. Used in JSON unmarshalling so - that a single JSON field can accept either an individual - string or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of an input - parameter; Used to distinguish between a single string - and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - pipelineRef: - description: PipelineRef can be used to refer to a specific instance - of a Pipeline. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton Bundle. Deprecated: - Please use ResolverRef with the bundles resolver instead.' - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters used to identify - the referenced Tekton resource. Example entries might include - "repo" or "path" but the set of params ultimately depends - on the chosen resolver. - items: - description: Param declares an ParamValues to use for the - parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold a single - string or string array. Used in JSON unmarshalling - so that a single JSON field can accept either an individual - string or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of an - input parameter; Used to distinguish between a - single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver that should - perform resolution of the referenced Tekton resource, such - as "git". - type: string - type: object - pipelineSpec: - description: PipelineSpec defines the desired state of Pipeline. - properties: - description: - description: Description is a user-facing description of the - pipeline that may be used to populate a UI. - type: string - finally: - description: Finally declares the list of Tasks that execute - just before leaving the Pipeline i.e. either after all Tasks - are finished executing successfully or after a failure which - would result in ending the Pipeline - items: - description: PipelineTask defines a task in a Pipeline, - passing inputs from both Params and from the output of - previous tasks. - properties: - matrix: - description: Matrix declares parameters used to fan - out this task. - properties: - params: - description: Params is a list of parameters used - to fan out the pipelineTask Params takes only - `Parameters` of type `"array"` Each array element - is supplied to the `PipelineTask` by substituting - `params` of type `"string"` in the underlying - `Task`. The names of the `params` in the `Matrix` - must match the names of the `params` in the underlying - `Task` that they will be substituting. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - name: - description: Name is the name of this task within the - context of a Pipeline. Name is used as a coordinate - with the `from` and `runAfter` fields to establish - the execution order of tasks relative to one another. - type: string - params: - description: Parameters declares parameters passed to - this task. - items: - description: Param declares an ParamValues to use - for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold - a single string or string array. Used in JSON - unmarshalling so that a single JSON field can - accept either an individual string or an array - of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array of - strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the resources given - to this task as inputs and outputs. - properties: - inputs: - description: Inputs holds the mapping from the PipelineResources - declared in DeclaredPipelineResources to the input - PipelineResources required by the Task. - items: - description: PipelineTaskInputResource maps the - name of a declared PipelineResource input dependency - in a Task to the resource in the Pipeline's - DeclaredPipelineResources that should be used. - This input may come from a previous task. - properties: - from: - description: From is the list of PipelineTask - names that the resource has to come from. - (Implies an ordering in the execution graph.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the DeclaredPipelineResource - to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by the - Task. - items: - description: PipelineTaskOutputResource maps the - name of a declared PipelineResource output dependency - in a Task to the resource in the Pipeline's - DeclaredPipelineResources that should be used. - properties: - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the DeclaredPipelineResource - to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - type: object - retries: - description: 'Retries represents how many times this - task should be retried in case of task failure: ConditionSucceeded - set to False' - type: integer - runAfter: - description: RunAfter is the list of PipelineTask names - that should be executed before this Task executes. - (Used to force a specific ordering in graph execution.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - taskRef: - description: TaskRef is a reference to a task definition. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton Bundle. - Deprecated: Please use ResolverRef with the bundles - resolver instead.' - type: string - kind: - description: TaskKind indicates the kind of the - task, namespaced or cluster scoped. - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters used - to identify the referenced Tekton resource. Example - entries might include "repo" or "path" but the - set of params ultimately depends on the chosen - resolver. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver - that should perform resolution of the referenced - Tekton resource, such as "git". - type: string - type: object - taskSpec: - description: TaskSpec is a specification of a task - properties: - apiVersion: - type: string - description: - description: Description is a user-facing description - of the task that may be used to populate a UI. - type: string - kind: - type: string - metadata: - description: PipelineTaskMetadata contains the labels - or annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - params: - description: Params is a list of input parameters - required to run the task. Params must be supplied - as inputs in TaskRuns unless they declare a default - value. - items: - description: ParamSpec defines arbitrary parameters - needed beyond typed inputs (such as resources). - Parameter values are provided by users as inputs - on a TaskRun or PipelineRun. - properties: - default: - description: Default is the value a parameter - takes if no input value is supplied. If - default is set, a Task may be executed without - a supplied value for the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing - description of the parameter that may be - used to populate a UI. - type: string - name: - description: Name declares the name by which - a parameter is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct - for object keys - properties: - type: - description: ParamType indicates the - type of an input parameter; Used to - distinguish between a single string - and an array of strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs parameter. - type: object - type: - description: Type is the user-specified type - of the parameter. The possible types are - currently "string", "array" and "object", - and "string" is the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources is a list input and output - resource to run the task Resources are represented - in TaskRuns as bindings to instances of PipelineResources. - properties: - inputs: - description: Inputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used to - refer to these Resources within the Task - definition, and when provided as an Input, - the Name will be the path to the volume - mounted containing this Resource as an input - (e.g. an input Resource named `workspace` - will be mounted at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name by - which a resource is referenced in the - definition. Resources may be referenced - by name in the definition of a Task's - steps. - type: string - optional: - description: 'Optional declares the resource - as optional. By default optional is - set to false which makes a resource - required. optional: true - the resource - is considered optional optional: false - - the resource is considered required - (equivalent of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path in - workspace directory where the resource - will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used to - refer to these Resources within the Task - definition, and when provided as an Input, - the Name will be the path to the volume - mounted containing this Resource as an input - (e.g. an input Resource named `workspace` - will be mounted at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name by - which a resource is referenced in the - definition. Resources may be referenced - by name in the definition of a Task's - steps. - type: string - optional: - description: 'Optional declares the resource - as optional. By default optional is - set to false which makes a resource - required. optional: true - the resource - is considered optional optional: false - - the resource is considered required - (equivalent of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path in - workspace directory where the resource - will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - type: object - results: - description: Results are values that this Task can - output - items: - description: TaskResult used to describe the results - of a task - properties: - description: - description: Description is a human-readable - description of the result - type: string - name: - description: Name the given name - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct - for object keys - properties: - type: - description: ParamType indicates the - type of an input parameter; Used to - distinguish between a single string - and an array of strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs results. - type: object - type: - description: Type is the user-specified type - of the result. The possible type is currently - "string" and will support "array" in following - work. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - sidecars: - description: Sidecars are run alongside the Task's - step containers. They begin before the steps start - and end after the steps complete. - items: - description: Sidecar has nearly the same data - structure as Step but does not have the ability - to timeout. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Sidecar''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the Sidecar. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a - ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key must - be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a - secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the Sidecar. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the Sidecar is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image name to be used by the - Sidecar. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management system - should take in response to Sidecar lifecycle - events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of Sidecar liveness. - Container will be restarted if the probe - fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Sidecar specified - as a DNS_LABEL. Each Sidecar in a Task must - have a unique name (DNS_LABEL). Cannot be - updated. - type: string - ports: - description: List of ports to expose from - the Sidecar. Exposing a port here gives - the system additional information about - the network connections a container uses, - but is primarily informational. Not specifying - a port here DOES NOT prevent that port from - being exposed. Any port which is listening - on the default "0.0.0.0" address inside - a container will be accessible from the - network. Cannot be updated. - items: - description: ContainerPort represents a - network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of Sidecar service - readiness. Container will be removed from - service endpoints if the probe fails. Cannot - be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Sidecar. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of an - executable file to execute. \n If Script - is not empty, the Step cannot have an Command - or Args." - type: string - securityContext: - description: 'SecurityContext defines the - security options the Sidecar should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must only - be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will only - be honored by components that enable - the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will result - in errors when validating the Pod. - All of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that - the Pod the Sidecar is running in has successfully - initialized. If specified, no other probes - are executed until this completes successfully. - If this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, - when it might take a long time to load data - or warm a cache, than during steady-state - operation. This cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this Sidecar should allocate - a buffer for stdin in the container runtime. - If this is not set, reads from stdin in - the Sidecar will always result in EOF. Default - is false. - type: boolean - stdinOnce: - description: Whether the container runtime - should close the stdin channel after it - has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If - stdinOnce is set to true, stdin is opened - on Sidecar start, is empty until the first - client attaches to stdin, and then remains - open and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the Sidecar is restarted. If - this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which the - file to which the Sidecar''s termination - message will be written is mounted into - the Sidecar''s filesystem. Message written - is intended to be brief final status, such - as an assertion failure message. Will be - truncated by the node if greater than 4096 - bytes. The total message length across all - containers will be limited to 12kb. Defaults - to /dev/termination-log. Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will use - the contents of terminationMessagePath to - populate the Sidecar status message on both - success and failure. FallbackToLogsOnError - will use the last chunk of Sidecar log output - if the termination message file is empty - and the Sidecar exited with an error. The - log output is limited to 2048 bytes or 80 - lines, whichever is smaller. Defaults to - File. Cannot be updated. - type: string - tty: - description: Whether this Sidecar should allocate - a TTY for itself, also requires 'stdin' - to be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Sidecar. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the device - will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Sidecar's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Sidecar's working directory. - If not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. - type: string - workspaces: - description: "This is an alpha field. You - must set the \"enable-api-fields\" feature - flag to \"alpha\" for this field to be supported. - \n Workspaces is a list of workspaces from - the Task that this Sidecar wants exclusive - access to. Adding a workspace to this list - means that any other Step or Sidecar that - does not also request this Workspace will - not have access to it." - items: - description: WorkspaceUsage is used by a - Step or Sidecar to declare that it wants - isolated access to a Workspace defined - in a Task. - properties: - mountPath: - description: MountPath is the path that - the workspace should be mounted to - inside the Step or Sidecar, overriding - any MountPath specified in the Task's - WorkspaceDeclaration. - type: string - name: - description: Name is the name of the - workspace this Step or Sidecar wants - access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - spec: - description: Spec is a specification of a custom - task - type: object - stepTemplate: - description: StepTemplate can be used as the basis - for all step containers within the Task, so that - the steps inherit settings on the base container. - properties: - args: - description: 'Arguments to the entrypoint. The - image''s CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded - using the Step''s environment. If a variable - cannot be resolved, the reference in the input - string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The docker image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Step''s environment. If a variable cannot - be resolved, the reference in the input string - will be unchanged. Double $$ are reduced to - a single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables to - set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment variable. - Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously defined - environment variables in the container - and any service environment variables. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to - a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap or its key must be - defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the - pod: supports metadata.name, metadata.namespace, - `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in - terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified API - version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret - in the pod's namespace - properties: - key: - description: The key of the secret - to select from. Must be a valid - secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret or its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the Step. The keys defined within - a source must be a C_IDENTIFIER. All invalid - keys will be reported as an event when the - container is starting. When a key exists in - multiple sources, the value associated with - the last source will take precedence. Values - defined by an Env with a duplicate key will - take precedence. Cannot be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - must be defined - type: boolean - type: object - prefix: - description: An optional identifier to - prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret - must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Default image name to use for - each Step. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level - config management to default or override container - images in workload controllers like Deployments - and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always if - :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will be - removed in a future release. Actions that - the management system should take in response - to container lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the handler - fails, the container is terminated and - restarted according to its restart policy. - Other management of the container blocks - until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is - NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this field - and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due to - an API request or management event such - as liveness/startup probe failure, preemption, - resource contention, etc. The handler - is not called if the container crashes - or exits. The Pod''s termination grace - period countdown begins before the PreStop - hook is executed. Regardless of the outcome - of the handler, the container will eventually - terminate within the Pod''s termination - grace period (unless delayed by finalizers). - Other management of the container blocks - until the hook completes or until the - termination grace period is reached. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is - NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this field - and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will be - removed in a future release. Periodic probe - of container liveness. Container will be restarted - if the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Deprecated. This field will be - removed in a future release. Default name - for each Step specified as a DNS_LABEL. Each - Step in a Task must have a unique name. Cannot - be updated. - type: string - ports: - description: Deprecated. This field will be - removed in a future release. List of ports - to expose from the Step's container. Exposing - a port here gives the system additional information - about the network connections a container - uses, but is primarily informational. Not - specifying a port here DOES NOT prevent that - port from being exposed. Any port which is - listening on the default "0.0.0.0" address - inside a container will be accessible from - the network. Cannot be updated. - items: - description: ContainerPort represents a network - port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must be - a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this must - match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must be - an IANA_SVC_NAME and unique within the - pod. Each named port in a pod must have - a unique name. Name for the port that - can be referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must be - UDP, TCP, or SCTP. Defaults to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will be - removed in a future release. Periodic probe - of container service readiness. Container - will be removed from service endpoints if - the probe fails. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Step. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the security - options the Step should be run with. If set, - the fields of SecurityContext override the - equivalent fields of PodSecurityContext. More - info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation controls - whether a process can gain more privileges - than its parent process. This bool directly - controls if the no_new_privs flag will - be set on the container process. AllowPrivilegeEscalation - is true always when the container is: - 1) run as Privileged 2) has CAP_SYS_ADMIN - Note that this field cannot be set when - spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to the - default set of capabilities granted by - the container runtime. Note that this - field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults for - readonly paths and masked paths. This - requires the ProcMountType feature flag - to be enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default is - false. Note that this field cannot be - set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image at - runtime to ensure that it does not run - as UID 0 (root) and fail to start the - container if it does. If unset or false, - no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied - to the container. If unspecified, the - container runtime will allocate a random - SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile must - be preconfigured on the node to work. - Must be a descending path, relative - to the kubelet's configured seccomp - profile location. Must only be set - if type is "Localhost". - type: string - type: - description: "type indicates which kind - of seccomp profile will be applied. - Valid options are: \n Localhost - - a profile defined in a file on the - node should be used. RuntimeDefault - - the container runtime default profile - should be used. Unconfined - no profile - should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name - is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where - the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as a - 'Host Process' container. This field - is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without - the feature flag will result in errors - when validating the Pod. All of a - Pod's containers must have the same - effective HostProcess value (it is - not allowed to have a mix of HostProcess - containers and non-HostProcess containers). In - addition, if HostProcess is true then - HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will be - removed in a future release. DeprecatedStartupProbe - indicates that the Pod has successfully initialized. - If specified, no other probes are executed - until this completes successfully. If this - probe fails, the Pod will be restarted, just - as if the livenessProbe failed. This can be - used to provide different probe parameters - at the beginning of a Pod''s lifecycle, when - it might take a long time to load data or - warm a cache, than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Deprecated. This field will be - removed in a future release. Whether this - Step should allocate a buffer for stdin in - the container runtime. If this is not set, - reads from stdin in the Step will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will be - removed in a future release. Whether the container - runtime should close the stdin channel after - it has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client attaches - to stdin, and then remains open and accepts - data until the client disconnects, at which - time stdin is closed and remains closed until - the container is restarted. If this flag is - false, a container processes that reads from - stdin will never receive an EOF. Default is - false - type: boolean - terminationMessagePath: - description: Deprecated. This field will be - removed in a future release and cannot be - meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will be - removed in a future release and cannot be - meaningfully used. - type: string - tty: - description: Deprecated. This field will be - removed in a future release. Whether this - Step should allocate a DeprecatedTTY for itself, - also requires 'stdin' to be true. Default - is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of block - devices to be used by the Step. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path inside - of the container that the device will - be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the host - to container and the other way around. - When not set, MountPropagationNone is - used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume from - which the container's volume should - be mounted. Defaults to "" (volume's - root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's volume - should be mounted. Behaves similarly - to SubPath but environment variable - references $(VAR_NAME) are expanded - using the container's environment. Defaults - to "" (volume's root). SubPathExpr and - SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If not - specified, the container runtime's default - will be used, which might be configured in - the container image. Cannot be updated. - type: string - required: - - name - type: object - steps: - description: Steps are the steps of the build; each - step is run sequentially with the source mounted - into /workspace. - items: - description: Step runs a subcomponent of a Task - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the container''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a - ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key must - be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a - secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the container. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the container is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image reference name to run - for this Step. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will be - removed in a future release. Actions that - the management system should take in response - to container lifecycle events. Cannot be - updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Step will be - restarted if the probe fails. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Step specified as - a DNS_LABEL. Each Step in a Task must have - a unique name. - type: string - onError: - description: OnError defines the exiting behavior - of a container on error can be set to [ - continue | stopAndFail ] - type: string - ports: - description: Deprecated. This field will be - removed in a future release. List of ports - to expose from the Step's container. Exposing - a port here gives the system additional - information about the network connections - a container uses, but is primarily informational. - Not specifying a port here DOES NOT prevent - that port from being exposed. Any port which - is listening on the default "0.0.0.0" address - inside a container will be accessible from - the network. Cannot be updated. - items: - description: ContainerPort represents a - network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. Step - will be removed from service endpoints if - the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Step. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of an - executable file to execute. \n If Script - is not empty, the Step cannot have an Command - and the Args will be passed to the Script." - type: string - securityContext: - description: 'SecurityContext defines the - security options the Step should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must only - be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will only - be honored by components that enable - the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will result - in errors when validating the Pod. - All of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod this Step runs in - has successfully initialized. If specified, - no other probes are executed until this - completes successfully. If this probe fails, - the Pod will be restarted, just as if the - livenessProbe failed. This can be used to - provide different probe parameters at the - beginning of a Pod''s lifecycle, when it - might take a long time to load data or warm - a cache, than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stderrConfig: - description: Stores configuration for the - stderr stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - stdin: - description: Deprecated. This field will be - removed in a future release. Whether this - container should allocate a buffer for stdin - in the container runtime. If this is not - set, reads from stdin in the container will - always result in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will be - removed in a future release. Whether the - container runtime should close the stdin - channel after it has been opened by a single - attach. When stdin is true the stdin stream - will remain open across multiple attach - sessions. If stdinOnce is set to true, stdin - is opened on container start, is empty until - the first client attaches to stdin, and - then remains open and accepts data until - the client disconnects, at which time stdin - is closed and remains closed until the container - is restarted. If this flag is false, a container - processes that reads from stdin will never - receive an EOF. Default is false - type: boolean - stdoutConfig: - description: Stores configuration for the - stdout stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - terminationMessagePath: - description: Deprecated. This field will be - removed in a future release and can't be - meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will be - removed in a future release and can't be - meaningfully used. - type: string - timeout: - description: 'Timeout is the time after which - the step times out. Defaults to never. Refer - to Go''s ParseDuration documentation for - expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - tty: - description: Deprecated. This field will be - removed in a future release. Whether this - container should allocate a DeprecatedTTY - for itself, also requires 'stdin' to be - true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Step. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the device - will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If - not specified, the container runtime's default - will be used, which might be configured - in the container image. Cannot be updated. - type: string - workspaces: - description: "This is an alpha field. You - must set the \"enable-api-fields\" feature - flag to \"alpha\" for this field to be supported. - \n Workspaces is a list of workspaces from - the Task that this Step wants exclusive - access to. Adding a workspace to this list - means that any other Step or Sidecar that - does not also request this Workspace will - not have access to it." - items: - description: WorkspaceUsage is used by a - Step or Sidecar to declare that it wants - isolated access to a Workspace defined - in a Task. - properties: - mountPath: - description: MountPath is the path that - the workspace should be mounted to - inside the Step or Sidecar, overriding - any MountPath specified in the Task's - WorkspaceDeclaration. - type: string - name: - description: Name is the name of the - workspace this Step or Sidecar wants - access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: Volumes is a collection of volumes - that are available to mount into the steps of - the build. - items: - description: Volume represents a named volume - in a pod that may be accessed by any container - in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will - force the readOnly setting in VolumeMounts. - More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of - the persistent disk resource in AWS - (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure - Data Disk mount on the host and bind mount - to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host - Caching mode: None, Read Only, Read - Write.' - type: string - diskName: - description: diskName is the Name of the - data disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of data - disk in the blob storage - type: string - fsType: - description: fsType is Filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are - Shared: multiple blob disks per storage - account Dedicated: single blob disk - per storage account Managed: azure - managed data disk (only in managed availability - set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure - File Service mount on the host and bind - mount to the pod. - properties: - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of - secret that contains Azure Storage Account - Name and Key - type: string - shareName: - description: shareName is the azure share - Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount - on the host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More - info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as - the mounted root, rather than the full - Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring for - User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is - the rados user name, default is admin - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters - used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is handled - by certain external CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the - CSI driver that handles this volume. - Consult with your admin for the correct - name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", - "xfs", "ntfs". If not provided, the - empty value is passed to the associated - CSI driver which will determine the - default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a - reference to the secret object containing - sensitive information to pass to the - CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This - field is optional, and may be empty - if no secret is required. If the secret - object contains more than one secret, - all secret references are passed. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults - to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI - driver. Consult your driver's documentation - for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward - API about the pod that should populate this - volume - properties: - defaultMode: - description: 'Optional: mode bits to use - on created files by default. Must be - a Optional: mode bits used to set permissions - on created files by default. Must be - an octal value between 0000 and 0777 - or a decimal value between 0 and 511. - YAML accepts both octal and decimal - values, JSON requires decimal values - for mode bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward - API volume file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace are - supported.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file - to be created. Must not be absolute - or contain the ''..'' path. Must - be utf-8 encoded. The first item - of the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type - of storage medium should back this directory. - The default is "" which means to use - the node''s default medium. Must be - an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage - on memory medium EmptyDir would be the - minimum value between the SizeLimit - specified here and the sum of memory - limits of all containers in a pod. The - default is nil which means that the - limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage driver. - The volume's lifecycle is tied to the pod - that defines it - it will be created before - the pod starts, and deleted when the pod - is removed. \n Use this if: a) the volume - is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot - or capacity tracking are needed, c) the - storage driver is specified through a storage - class, and d) the storage driver supports - dynamic volume provisioning through a - PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection - between this volume type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one of the - vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual - pod. \n Use CSI for light-weight local ephemeral - volumes if the CSI driver is meant to be - used that way - see the documentation of - the driver for more information. \n A pod - can use both types of ephemeral volumes - and persistent volumes at the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a - stand-alone PVC to provision the volume. - The pod in which this EphemeralVolumeSource - is embedded will be the owner of the - PVC, i.e. the PVC will be deleted together - with the pod. The name of the PVC will - be `-` where - `` is the name from the - `PodSpec.Volumes` array entry. Pod validation - will reject the pod if the concatenated - name is not valid for a PVC (for example, - too long). \n An existing PVC with that - name that is not owned by the pod will - *not* be used for the pod to avoid using - an unrelated volume by mistake. Starting - the pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod exists. - Normally this should not be necessary, - but it may be useful when manually reconstructing - a broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels and - annotations that will be copied - into the PVC when creating it. No - other fields are allowed and will - be rejected during validation. - type: object - spec: - description: The specification for - the PersistentVolumeClaim. The entire - content is copied unchanged into - the PVC that gets created from this - template. The same fields as in - a PersistentVolumeClaim are also - valid here. - properties: - accessModes: - description: 'accessModes contains - the desired access modes the - volume should have. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create - a new volume based on the contents - of the specified data source. - If the AnyVolumeDataSource feature - gate is enabled, this field - will always have the same contents - as the DataSourceRef field.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may - be any local object from a non-empty - API group (non core object) - or a PersistentVolumeClaim object. - When this field is specified, - volume binding will only succeed - if the type of the specified - object matches some installed - volume populator or dynamic - provisioner. This field will - replace the functionality of - the DataSource field and as - such if both fields are non-empty, - they must have the same value. - For backwards compatibility, - both fields (DataSource and - DataSourceRef) will be set to - the same value automatically - if one of them is empty and - the other is non-empty. There - are two important differences - between DataSource and DataSourceRef: - * While DataSource only allows - two specific types of objects, - DataSourceRef allows any non-core - object, as well as PersistentVolumeClaim - objects. * While DataSource - ignores disallowed values (dropping - them), DataSourceRef preserves - all values, and generates an - error if a disallowed value - is specified. (Beta) Using - this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the volume - should have. If RecoverVolumeExpansionFailure - feature is enabled users are - allowed to specify resource - requirements that are lower - than previous value but must - still be higher than capacity - recorded in the status field - of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of compute - resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, - it defaults to Limits if - that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label - query over volumes to consider - for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is the - binding reference to the PersistentVolume - backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel - resource that is attached to a kubelet's - host machine and then exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target - lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: - FC target worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs and - lun must be set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. - properties: - driver: - description: driver is the name of the - driver to use for this volume. - type: string - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The - default filesystem depends on FlexVolume - script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this - field holds extra command options if - any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the - plugin scripts. This may be empty if - no secret object is specified. If the - secret object contains more than one - secret, all secrets are passed to the - plugin scripts.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker - volume attached to a kubelet's host machine. - This depends on the Flocker control service - being running - properties: - datasetName: - description: datasetName is Name of the - dataset stored as metadata -> name on - the dataset for Flocker should be considered - as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of - the dataset. This is unique identifier - of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type - of the volume that you want to mount. - Tip: Ensure that the filesystem type - is supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of - the PD resource in GCE. Used to identify - the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container - with a git repo, mount an EmptyDir into - an InitContainer that clones the repo using - git, then mount the EmptyDir into the Pod''s - container.' - properties: - directory: - description: directory is the target directory - name. Must not contain or start with - '..'. If '.' is supplied, the volume - directory will be the git repository. Otherwise, - if specified, the volume will contain - the git repository in the subdirectory - with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash - for the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume - path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted with - read-only permissions. Defaults to false. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that - is directly exposed to the container. This - is generally used for system agents or other - privileged things that are allowed to see - the host machine. Most containers will NOT - need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who - can use host directory mounts and who can/can - not mount host directories as read/write.' - properties: - path: - description: 'path of the directory on - the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk - resource that is attached to a kubelet''s - host machine and then exposed to the pod. - More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines - whether support iSCSI Discovery CHAP - authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether - support iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom - iSCSI Initiator Name. If initiatorName - is specified with iscsiInterface simultaneously, - new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified - Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target - Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target - Portal List. The portal is either an - IP or ip_addr:port if the port is other - than default (typically TCP ports 860 - and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret - for iSCSI target and initiator authentication - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target - Portal. The Portal is either an IP or - ip_addr:port if the port is other than - default (typically TCP ports 860 and - 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be - a DNS_LABEL and unique within the pod. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force - the NFS export to be mounted with read-only - permissions. Defaults to false. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or - IP address of the NFS server. More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of - a PersistentVolumeClaim in the same - namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents - a PhotonController persistent disk attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one - resources secrets, configmaps, and downward - API - properties: - defaultMode: - description: defaultMode are the mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both - octal and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume - projections - items: - description: Projection that may be - projected along with other supported - volume types - properties: - configMap: - description: configMap information - about the configMap data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - ConfigMap will be projected - into the volume as a file - whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - ConfigMap, the volume setup - will error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional specify - whether the ConfigMap or its - keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data to - project - properties: - items: - description: Items is a list - of DownwardAPIVolume file - items: - description: DownwardAPIVolumeFile - represents information to - create the file containing - the pod field - properties: - fieldRef: - description: 'Required: - Selects a field of the - pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version - of the schema the - FieldPath is written - in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path - of the field to - select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: - mode bits used to set - permissions on this - file, must be an octal - value between 0000 and - 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and - decimal values, JSON - requires decimal values - for mode bits. If not - specified, the volume - defaultMode will be - used. This might be - in conflict with other - options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: - Path is the relative - path name of the file - to be created. Must - not be absolute or contain - the ''..'' path. Must - be utf-8 encoded. The - first item of the relative - path must not start - with ''..''' - type: string - resourceFieldRef: - description: 'Selects - a resource of the container: - only resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for - volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format - of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information - about the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - Secret will be projected into - the volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - Secret, the volume setup will - error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional field - specify whether the Secret - or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken - is information about the serviceAccountToken - data to project - properties: - audience: - description: audience is the - intended audience of the token. - A recipient of a token must - identify itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. The - audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the token - approaches expiration, the - kubelet volume plugin will - proactively rotate the service - account token. The kubelet - will start trying to rotate - the token if the token is - older than 80 percent of its - time to live or if the token - is older than 24 hours.Defaults - to 1 hour and must be at least - 10 minutes. - format: int64 - type: integer - path: - description: path is the path - relative to the mount point - of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte - mount on the host that shares a pod's lifetime - properties: - group: - description: group to map volume access - to Default is no group - type: string - readOnly: - description: readOnly here will force - the Quobyte volume to be mounted with - read-only permissions. Defaults to false. - type: boolean - registry: - description: registry represents a single - or multiple Quobyte Registry services - specified as a string as host:port pair - (multiple entries are separated with - commas) which acts as the central registry - for volumes - type: string - tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is - set by the plugin - type: string - user: - description: user to map volume access - to Defaults to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by - name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key - ring for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. - Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the - authentication secret for RBDUser. If - provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. - Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO - persistent volume attached and mounted on - Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default - is "xfs". - type: string - gateway: - description: gateway is the host address - of the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name - of the ScaleIO Protection Domain for - the configured storage. - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the - secret for ScaleIO user and other sensitive - information. If this is not provided, - Login operation will fail. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, default - false - type: boolean - storageMode: - description: storageMode indicates whether - the storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO - Storage Pool associated with the protection - domain. - type: string - system: - description: system is the name of the - storage system as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of - a volume already created in the ScaleIO - system that is associated with this - volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that - should populate this volume. More info: - https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether - the Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of - the secret in the pod''s namespace to - use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes - nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API - credentials. If not specified, default - values will be attempted. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume - names are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the Pod's - namespace will be used. This allows - the Kubernetes name scoping to be mirrored - within StorageOS for tighter integration. - Set VolumeName to any name to override - the default behaviour. Set to "default" - if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist - within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fsType is filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage - Policy Based Management (SPBM) profile - ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the - storage Policy Based Management (SPBM) - profile name. - type: string - volumePath: - description: volumePath is the path that - identifies vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces are the volumes that this - Task requires. - items: - description: WorkspaceDeclaration is a declaration - of a volume that a Task requires. - properties: - description: - description: Description is an optional human - readable description of this volume. - type: string - mountPath: - description: MountPath overrides the directory - that the volume will be made available at. - type: string - name: - description: Name is the name by which you - can bind the volume at runtime. - type: string - optional: - description: Optional marks a Workspace as - not being required in TaskRuns. By default - this field is false and so declared workspaces - are required. - type: boolean - readOnly: - description: ReadOnly dictates whether a mounted - volume is writable. By default this field - is false and so mounted volumes are writable. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - timeout: - description: 'Time after which the TaskRun times out. - Defaults to 1 hour. Specified TaskRun timeout should - be less than 24h. Refer Go''s ParseDuration documentation - for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - when: - description: WhenExpressions is a list of when expressions - that need to be true for the task to run - items: - description: WhenExpression allows a PipelineTask - to declare expressions to be evaluated before the - Task is run to determine whether the Task should - be executed or skipped - properties: - input: - description: Input is the string for guard checking - which can be a static input or an output from - a parent Task - type: string - operator: - description: Operator that represents an Input's - relationship to the values - type: string - values: - description: Values is an array of strings, which - is compared against the input, for guard checking - It must be non-empty - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - input - - operator - - values - type: object - type: array - workspaces: - description: Workspaces maps workspaces from the pipeline - spec to the workspaces declared in the Task. - items: - description: WorkspacePipelineTaskBinding describes - how a workspace passed into the pipeline should - be mapped to a task's declared workspace. - properties: - name: - description: Name is the name of the workspace - as declared by the task - type: string - subPath: - description: SubPath is optionally a directory - on the volume which should be used for this - binding (i.e. the volume will be mounted at - this sub directory). - type: string - workspace: - description: Workspace is the name of the workspace - declared by the pipeline - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - params: - description: Params declares a list of input parameters that - must be supplied when this Pipeline is run. - items: - description: ParamSpec defines arbitrary parameters needed - beyond typed inputs (such as resources). Parameter values - are provided by users as inputs on a TaskRun or PipelineRun. - properties: - default: - description: Default is the value a parameter takes - if no input value is supplied. If default is set, - a Task may be executed without a supplied value for - the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of an - input parameter; Used to distinguish between a - single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing description - of the parameter that may be used to populate a UI. - type: string - name: - description: Name declares the name by which a parameter - is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct for object - keys - properties: - type: - description: ParamType indicates the type of an - input parameter; Used to distinguish between - a single string and an array of strings. - type: string - type: object - description: Properties is the JSON Schema properties - to support key-value pairs parameter. - type: object - type: - description: Type is the user-specified type of the - parameter. The possible types are currently "string", - "array" and "object", and "string" is the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the names and types of the - resources given to the Pipeline's tasks as inputs and outputs. - items: - description: PipelineDeclaredResource is used by a Pipeline - to declare the types of the PipelineResources that it - will required to run and names which can be used to refer - to these PipelineResources in PipelineTaskResourceBindings. - properties: - name: - description: Name is the name that will be used by the - Pipeline to refer to this resource. It does not directly - correspond to the name of any PipelineResources Task - inputs or outputs, and it does not correspond to the - actual names of the PipelineResources that will be - bound in the PipelineRun. - type: string - optional: - description: 'Optional declares the resource as optional. - optional: true - the resource is considered optional - optional: false - the resource is considered required - (default/equivalent of not specifying it)' - type: boolean - type: - description: Type is the type of the PipelineResource. - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - results: - description: Results are values that this pipeline can output - once run - items: - description: PipelineResult used to describe the results - of a pipeline - properties: - description: - description: Description is a human-readable description - of the result - type: string - name: - description: Name the given name - type: string - type: - description: Type is the user-specified type of the - result. The possible types are 'string', 'array', - and 'object', with 'string' as the default. 'array' - and 'object' types are alpha features. - type: string - value: - description: Value the expression used to retrieve the - value - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of an - input parameter; Used to distinguish between a - single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - tasks: - description: Tasks declares the graph of Tasks that execute - when this Pipeline is run. - items: - description: PipelineTask defines a task in a Pipeline, - passing inputs from both Params and from the output of - previous tasks. - properties: - matrix: - description: Matrix declares parameters used to fan - out this task. - properties: - params: - description: Params is a list of parameters used - to fan out the pipelineTask Params takes only - `Parameters` of type `"array"` Each array element - is supplied to the `PipelineTask` by substituting - `params` of type `"string"` in the underlying - `Task`. The names of the `params` in the `Matrix` - must match the names of the `params` in the underlying - `Task` that they will be substituting. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - name: - description: Name is the name of this task within the - context of a Pipeline. Name is used as a coordinate - with the `from` and `runAfter` fields to establish - the execution order of tasks relative to one another. - type: string - params: - description: Parameters declares parameters passed to - this task. - items: - description: Param declares an ParamValues to use - for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold - a single string or string array. Used in JSON - unmarshalling so that a single JSON field can - accept either an individual string or an array - of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array of - strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the resources given - to this task as inputs and outputs. - properties: - inputs: - description: Inputs holds the mapping from the PipelineResources - declared in DeclaredPipelineResources to the input - PipelineResources required by the Task. - items: - description: PipelineTaskInputResource maps the - name of a declared PipelineResource input dependency - in a Task to the resource in the Pipeline's - DeclaredPipelineResources that should be used. - This input may come from a previous task. - properties: - from: - description: From is the list of PipelineTask - names that the resource has to come from. - (Implies an ordering in the execution graph.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the DeclaredPipelineResource - to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by the - Task. - items: - description: PipelineTaskOutputResource maps the - name of a declared PipelineResource output dependency - in a Task to the resource in the Pipeline's - DeclaredPipelineResources that should be used. - properties: - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the DeclaredPipelineResource - to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - type: object - retries: - description: 'Retries represents how many times this - task should be retried in case of task failure: ConditionSucceeded - set to False' - type: integer - runAfter: - description: RunAfter is the list of PipelineTask names - that should be executed before this Task executes. - (Used to force a specific ordering in graph execution.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - taskRef: - description: TaskRef is a reference to a task definition. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton Bundle. - Deprecated: Please use ResolverRef with the bundles - resolver instead.' - type: string - kind: - description: TaskKind indicates the kind of the - task, namespaced or cluster scoped. - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters used - to identify the referenced Tekton resource. Example - entries might include "repo" or "path" but the - set of params ultimately depends on the chosen - resolver. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver - that should perform resolution of the referenced - Tekton resource, such as "git". - type: string - type: object - taskSpec: - description: TaskSpec is a specification of a task - properties: - apiVersion: - type: string - description: - description: Description is a user-facing description - of the task that may be used to populate a UI. - type: string - kind: - type: string - metadata: - description: PipelineTaskMetadata contains the labels - or annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - params: - description: Params is a list of input parameters - required to run the task. Params must be supplied - as inputs in TaskRuns unless they declare a default - value. - items: - description: ParamSpec defines arbitrary parameters - needed beyond typed inputs (such as resources). - Parameter values are provided by users as inputs - on a TaskRun or PipelineRun. - properties: - default: - description: Default is the value a parameter - takes if no input value is supplied. If - default is set, a Task may be executed without - a supplied value for the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing - description of the parameter that may be - used to populate a UI. - type: string - name: - description: Name declares the name by which - a parameter is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct - for object keys - properties: - type: - description: ParamType indicates the - type of an input parameter; Used to - distinguish between a single string - and an array of strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs parameter. - type: object - type: - description: Type is the user-specified type - of the parameter. The possible types are - currently "string", "array" and "object", - and "string" is the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources is a list input and output - resource to run the task Resources are represented - in TaskRuns as bindings to instances of PipelineResources. - properties: - inputs: - description: Inputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used to - refer to these Resources within the Task - definition, and when provided as an Input, - the Name will be the path to the volume - mounted containing this Resource as an input - (e.g. an input Resource named `workspace` - will be mounted at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name by - which a resource is referenced in the - definition. Resources may be referenced - by name in the definition of a Task's - steps. - type: string - optional: - description: 'Optional declares the resource - as optional. By default optional is - set to false which makes a resource - required. optional: true - the resource - is considered optional optional: false - - the resource is considered required - (equivalent of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path in - workspace directory where the resource - will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used to - refer to these Resources within the Task - definition, and when provided as an Input, - the Name will be the path to the volume - mounted containing this Resource as an input - (e.g. an input Resource named `workspace` - will be mounted at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name by - which a resource is referenced in the - definition. Resources may be referenced - by name in the definition of a Task's - steps. - type: string - optional: - description: 'Optional declares the resource - as optional. By default optional is - set to false which makes a resource - required. optional: true - the resource - is considered optional optional: false - - the resource is considered required - (equivalent of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path in - workspace directory where the resource - will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - type: object - results: - description: Results are values that this Task can - output - items: - description: TaskResult used to describe the results - of a task - properties: - description: - description: Description is a human-readable - description of the result - type: string - name: - description: Name the given name - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct - for object keys - properties: - type: - description: ParamType indicates the - type of an input parameter; Used to - distinguish between a single string - and an array of strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs results. - type: object - type: - description: Type is the user-specified type - of the result. The possible type is currently - "string" and will support "array" in following - work. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - sidecars: - description: Sidecars are run alongside the Task's - step containers. They begin before the steps start - and end after the steps complete. - items: - description: Sidecar has nearly the same data - structure as Step but does not have the ability - to timeout. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Sidecar''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the Sidecar. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a - ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key must - be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a - secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the Sidecar. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the Sidecar is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image name to be used by the - Sidecar. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management system - should take in response to Sidecar lifecycle - events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of Sidecar liveness. - Container will be restarted if the probe - fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Sidecar specified - as a DNS_LABEL. Each Sidecar in a Task must - have a unique name (DNS_LABEL). Cannot be - updated. - type: string - ports: - description: List of ports to expose from - the Sidecar. Exposing a port here gives - the system additional information about - the network connections a container uses, - but is primarily informational. Not specifying - a port here DOES NOT prevent that port from - being exposed. Any port which is listening - on the default "0.0.0.0" address inside - a container will be accessible from the - network. Cannot be updated. - items: - description: ContainerPort represents a - network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of Sidecar service - readiness. Container will be removed from - service endpoints if the probe fails. Cannot - be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Sidecar. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of an - executable file to execute. \n If Script - is not empty, the Step cannot have an Command - or Args." - type: string - securityContext: - description: 'SecurityContext defines the - security options the Sidecar should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must only - be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will only - be honored by components that enable - the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will result - in errors when validating the Pod. - All of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that - the Pod the Sidecar is running in has successfully - initialized. If specified, no other probes - are executed until this completes successfully. - If this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, - when it might take a long time to load data - or warm a cache, than during steady-state - operation. This cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this Sidecar should allocate - a buffer for stdin in the container runtime. - If this is not set, reads from stdin in - the Sidecar will always result in EOF. Default - is false. - type: boolean - stdinOnce: - description: Whether the container runtime - should close the stdin channel after it - has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If - stdinOnce is set to true, stdin is opened - on Sidecar start, is empty until the first - client attaches to stdin, and then remains - open and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the Sidecar is restarted. If - this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which the - file to which the Sidecar''s termination - message will be written is mounted into - the Sidecar''s filesystem. Message written - is intended to be brief final status, such - as an assertion failure message. Will be - truncated by the node if greater than 4096 - bytes. The total message length across all - containers will be limited to 12kb. Defaults - to /dev/termination-log. Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will use - the contents of terminationMessagePath to - populate the Sidecar status message on both - success and failure. FallbackToLogsOnError - will use the last chunk of Sidecar log output - if the termination message file is empty - and the Sidecar exited with an error. The - log output is limited to 2048 bytes or 80 - lines, whichever is smaller. Defaults to - File. Cannot be updated. - type: string - tty: - description: Whether this Sidecar should allocate - a TTY for itself, also requires 'stdin' - to be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Sidecar. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the device - will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Sidecar's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Sidecar's working directory. - If not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. - type: string - workspaces: - description: "This is an alpha field. You - must set the \"enable-api-fields\" feature - flag to \"alpha\" for this field to be supported. - \n Workspaces is a list of workspaces from - the Task that this Sidecar wants exclusive - access to. Adding a workspace to this list - means that any other Step or Sidecar that - does not also request this Workspace will - not have access to it." - items: - description: WorkspaceUsage is used by a - Step or Sidecar to declare that it wants - isolated access to a Workspace defined - in a Task. - properties: - mountPath: - description: MountPath is the path that - the workspace should be mounted to - inside the Step or Sidecar, overriding - any MountPath specified in the Task's - WorkspaceDeclaration. - type: string - name: - description: Name is the name of the - workspace this Step or Sidecar wants - access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - spec: - description: Spec is a specification of a custom - task - type: object - stepTemplate: - description: StepTemplate can be used as the basis - for all step containers within the Task, so that - the steps inherit settings on the base container. - properties: - args: - description: 'Arguments to the entrypoint. The - image''s CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded - using the Step''s environment. If a variable - cannot be resolved, the reference in the input - string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The docker image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Step''s environment. If a variable cannot - be resolved, the reference in the input string - will be unchanged. Double $$ are reduced to - a single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables to - set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment variable. - Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously defined - environment variables in the container - and any service environment variables. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to - a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap or its key must be - defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the - pod: supports metadata.name, metadata.namespace, - `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in - terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified API - version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret - in the pod's namespace - properties: - key: - description: The key of the secret - to select from. Must be a valid - secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret or its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the Step. The keys defined within - a source must be a C_IDENTIFIER. All invalid - keys will be reported as an event when the - container is starting. When a key exists in - multiple sources, the value associated with - the last source will take precedence. Values - defined by an Env with a duplicate key will - take precedence. Cannot be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - must be defined - type: boolean - type: object - prefix: - description: An optional identifier to - prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret - must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Default image name to use for - each Step. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level - config management to default or override container - images in workload controllers like Deployments - and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always if - :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will be - removed in a future release. Actions that - the management system should take in response - to container lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the handler - fails, the container is terminated and - restarted according to its restart policy. - Other management of the container blocks - until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is - NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this field - and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due to - an API request or management event such - as liveness/startup probe failure, preemption, - resource contention, etc. The handler - is not called if the container crashes - or exits. The Pod''s termination grace - period countdown begins before the PreStop - hook is executed. Regardless of the outcome - of the handler, the container will eventually - terminate within the Pod''s termination - grace period (unless delayed by finalizers). - Other management of the container blocks - until the hook completes or until the - termination grace period is reached. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is - NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this field - and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will be - removed in a future release. Periodic probe - of container liveness. Container will be restarted - if the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Deprecated. This field will be - removed in a future release. Default name - for each Step specified as a DNS_LABEL. Each - Step in a Task must have a unique name. Cannot - be updated. - type: string - ports: - description: Deprecated. This field will be - removed in a future release. List of ports - to expose from the Step's container. Exposing - a port here gives the system additional information - about the network connections a container - uses, but is primarily informational. Not - specifying a port here DOES NOT prevent that - port from being exposed. Any port which is - listening on the default "0.0.0.0" address - inside a container will be accessible from - the network. Cannot be updated. - items: - description: ContainerPort represents a network - port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must be - a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this must - match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must be - an IANA_SVC_NAME and unique within the - pod. Each named port in a pod must have - a unique name. Name for the port that - can be referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must be - UDP, TCP, or SCTP. Defaults to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will be - removed in a future release. Periodic probe - of container service readiness. Container - will be removed from service endpoints if - the probe fails. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Step. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the security - options the Step should be run with. If set, - the fields of SecurityContext override the - equivalent fields of PodSecurityContext. More - info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation controls - whether a process can gain more privileges - than its parent process. This bool directly - controls if the no_new_privs flag will - be set on the container process. AllowPrivilegeEscalation - is true always when the container is: - 1) run as Privileged 2) has CAP_SYS_ADMIN - Note that this field cannot be set when - spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to the - default set of capabilities granted by - the container runtime. Note that this - field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults for - readonly paths and masked paths. This - requires the ProcMountType feature flag - to be enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default is - false. Note that this field cannot be - set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image at - runtime to ensure that it does not run - as UID 0 (root) and fail to start the - container if it does. If unset or false, - no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied - to the container. If unspecified, the - container runtime will allocate a random - SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile must - be preconfigured on the node to work. - Must be a descending path, relative - to the kubelet's configured seccomp - profile location. Must only be set - if type is "Localhost". - type: string - type: - description: "type indicates which kind - of seccomp profile will be applied. - Valid options are: \n Localhost - - a profile defined in a file on the - node should be used. RuntimeDefault - - the container runtime default profile - should be used. Unconfined - no profile - should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name - is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where - the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as a - 'Host Process' container. This field - is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without - the feature flag will result in errors - when validating the Pod. All of a - Pod's containers must have the same - effective HostProcess value (it is - not allowed to have a mix of HostProcess - containers and non-HostProcess containers). In - addition, if HostProcess is true then - HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will be - removed in a future release. DeprecatedStartupProbe - indicates that the Pod has successfully initialized. - If specified, no other probes are executed - until this completes successfully. If this - probe fails, the Pod will be restarted, just - as if the livenessProbe failed. This can be - used to provide different probe parameters - at the beginning of a Pod''s lifecycle, when - it might take a long time to load data or - warm a cache, than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to - take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it is - not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to 3. - Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving - a GRPC port. This is a beta field and - requires enabling GRPCContainerProbe feature - gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of - the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default - behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect to, - defaults to the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set in - the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in HTTP - probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP - server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the - container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform - the probe. Default to 10 seconds. Minimum - value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. Must - be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name to - connect to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port - to access on the container. Number - must be in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period is - the duration in seconds after the processes - running in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill signal. - Set this value longer than the expected - cleanup time for your process. If this - value is nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value overrides - the value provided by the pod spec. Value - must be non-negative integer. The value - zero indicates stop immediately via the - kill signal (no opportunity to shut down). - This is a beta field and requires enabling - ProbeTerminationGracePeriod feature gate. - Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which - the probe times out. Defaults to 1 second. - Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Deprecated. This field will be - removed in a future release. Whether this - Step should allocate a buffer for stdin in - the container runtime. If this is not set, - reads from stdin in the Step will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will be - removed in a future release. Whether the container - runtime should close the stdin channel after - it has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client attaches - to stdin, and then remains open and accepts - data until the client disconnects, at which - time stdin is closed and remains closed until - the container is restarted. If this flag is - false, a container processes that reads from - stdin will never receive an EOF. Default is - false - type: boolean - terminationMessagePath: - description: Deprecated. This field will be - removed in a future release and cannot be - meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will be - removed in a future release and cannot be - meaningfully used. - type: string - tty: - description: Deprecated. This field will be - removed in a future release. Whether this - Step should allocate a DeprecatedTTY for itself, - also requires 'stdin' to be true. Default - is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of block - devices to be used by the Step. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path inside - of the container that the device will - be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the host - to container and the other way around. - When not set, MountPropagationNone is - used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume from - which the container's volume should - be mounted. Defaults to "" (volume's - root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's volume - should be mounted. Behaves similarly - to SubPath but environment variable - references $(VAR_NAME) are expanded - using the container's environment. Defaults - to "" (volume's root). SubPathExpr and - SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If not - specified, the container runtime's default - will be used, which might be configured in - the container image. Cannot be updated. - type: string - required: - - name - type: object - steps: - description: Steps are the steps of the build; each - step is run sequentially with the source mounted - into /workspace. - items: - description: Step runs a subcomponent of a Task - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the container''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used if - value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a - ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key must - be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a - secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate environment - variables in the container. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the container is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. - items: - description: EnvFromSource represents the - source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image reference name to run - for this Step. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will be - removed in a future release. Actions that - the management system should take in response - to container lifecycle events. Cannot be - updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Step will be - restarted if the probe fails. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Step specified as - a DNS_LABEL. Each Step in a Task must have - a unique name. - type: string - onError: - description: OnError defines the exiting behavior - of a container on error can be set to [ - continue | stopAndFail ] - type: string - ports: - description: Deprecated. This field will be - removed in a future release. List of ports - to expose from the Step's container. Exposing - a port here gives the system additional - information about the network connections - a container uses, but is primarily informational. - Not specifying a port here DOES NOT prevent - that port from being exposed. Any port which - is listening on the default "0.0.0.0" address - inside a container will be accessible from - the network. Cannot be updated. - items: - description: ContainerPort represents a - network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the - external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. Step - will be removed from service endpoints if - the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by - this Step. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of an - executable file to execute. \n If Script - is not empty, the Step cannot have an Command - and the Args will be passed to the Script." - type: string - securityContext: - description: 'SecurityContext defines the - security options the Step should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must only - be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will only - be honored by components that enable - the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will result - in errors when validating the Pod. - All of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod this Step runs in - has successfully initialized. If specified, - no other probes are executed until this - completes successfully. If this probe fails, - the Pod will be restarted, just as if the - livenessProbe failed. This can be used to - provide different probe parameters at the - beginning of a Pod''s lifecycle, when it - might take a long time to load data or warm - a cache, than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC - service. Number must be in the range - 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action - involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the pod - IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stderrConfig: - description: Stores configuration for the - stderr stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - stdin: - description: Deprecated. This field will be - removed in a future release. Whether this - container should allocate a buffer for stdin - in the container runtime. If this is not - set, reads from stdin in the container will - always result in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will be - removed in a future release. Whether the - container runtime should close the stdin - channel after it has been opened by a single - attach. When stdin is true the stdin stream - will remain open across multiple attach - sessions. If stdinOnce is set to true, stdin - is opened on container start, is empty until - the first client attaches to stdin, and - then remains open and accepts data until - the client disconnects, at which time stdin - is closed and remains closed until the container - is restarted. If this flag is false, a container - processes that reads from stdin will never - receive an EOF. Default is false - type: boolean - stdoutConfig: - description: Stores configuration for the - stdout stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - terminationMessagePath: - description: Deprecated. This field will be - removed in a future release and can't be - meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will be - removed in a future release and can't be - meaningfully used. - type: string - timeout: - description: 'Timeout is the time after which - the step times out. Defaults to never. Refer - to Go''s ParseDuration documentation for - expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - tty: - description: Deprecated. This field will be - removed in a future release. Whether this - container should allocate a DeprecatedTTY - for itself, also requires 'stdin' to be - true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Step. - items: - description: volumeDevice describes a mapping - of a raw block device within a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the device - will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If - not specified, the container runtime's default - will be used, which might be configured - in the container image. Cannot be updated. - type: string - workspaces: - description: "This is an alpha field. You - must set the \"enable-api-fields\" feature - flag to \"alpha\" for this field to be supported. - \n Workspaces is a list of workspaces from - the Task that this Step wants exclusive - access to. Adding a workspace to this list - means that any other Step or Sidecar that - does not also request this Workspace will - not have access to it." - items: - description: WorkspaceUsage is used by a - Step or Sidecar to declare that it wants - isolated access to a Workspace defined - in a Task. - properties: - mountPath: - description: MountPath is the path that - the workspace should be mounted to - inside the Step or Sidecar, overriding - any MountPath specified in the Task's - WorkspaceDeclaration. - type: string - name: - description: Name is the name of the - workspace this Step or Sidecar wants - access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: Volumes is a collection of volumes - that are available to mount into the steps of - the build. - items: - description: Volume represents a named volume - in a pod that may be accessed by any container - in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will - force the readOnly setting in VolumeMounts. - More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of - the persistent disk resource in AWS - (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure - Data Disk mount on the host and bind mount - to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host - Caching mode: None, Read Only, Read - Write.' - type: string - diskName: - description: diskName is the Name of the - data disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of data - disk in the blob storage - type: string - fsType: - description: fsType is Filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are - Shared: multiple blob disks per storage - account Dedicated: single blob disk - per storage account Managed: azure - managed data disk (only in managed availability - set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure - File Service mount on the host and bind - mount to the pod. - properties: - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of - secret that contains Azure Storage Account - Name and Key - type: string - shareName: - description: shareName is the azure share - Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount - on the host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More - info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as - the mounted root, rather than the full - Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring for - User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is - the rados user name, default is admin - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters - used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is handled - by certain external CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the - CSI driver that handles this volume. - Consult with your admin for the correct - name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", - "xfs", "ntfs". If not provided, the - empty value is passed to the associated - CSI driver which will determine the - default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a - reference to the secret object containing - sensitive information to pass to the - CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This - field is optional, and may be empty - if no secret is required. If the secret - object contains more than one secret, - all secret references are passed. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults - to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI - driver. Consult your driver's documentation - for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward - API about the pod that should populate this - volume - properties: - defaultMode: - description: 'Optional: mode bits to use - on created files by default. Must be - a Optional: mode bits used to set permissions - on created files by default. Must be - an octal value between 0000 and 0777 - or a decimal value between 0 and 511. - YAML accepts both octal and decimal - values, JSON requires decimal values - for mode bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward - API volume file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace are - supported.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file - to be created. Must not be absolute - or contain the ''..'' path. Must - be utf-8 encoded. The first item - of the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type - of storage medium should back this directory. - The default is "" which means to use - the node''s default medium. Must be - an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage - on memory medium EmptyDir would be the - minimum value between the SizeLimit - specified here and the sum of memory - limits of all containers in a pod. The - default is nil which means that the - limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage driver. - The volume's lifecycle is tied to the pod - that defines it - it will be created before - the pod starts, and deleted when the pod - is removed. \n Use this if: a) the volume - is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot - or capacity tracking are needed, c) the - storage driver is specified through a storage - class, and d) the storage driver supports - dynamic volume provisioning through a - PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection - between this volume type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one of the - vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual - pod. \n Use CSI for light-weight local ephemeral - volumes if the CSI driver is meant to be - used that way - see the documentation of - the driver for more information. \n A pod - can use both types of ephemeral volumes - and persistent volumes at the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a - stand-alone PVC to provision the volume. - The pod in which this EphemeralVolumeSource - is embedded will be the owner of the - PVC, i.e. the PVC will be deleted together - with the pod. The name of the PVC will - be `-` where - `` is the name from the - `PodSpec.Volumes` array entry. Pod validation - will reject the pod if the concatenated - name is not valid for a PVC (for example, - too long). \n An existing PVC with that - name that is not owned by the pod will - *not* be used for the pod to avoid using - an unrelated volume by mistake. Starting - the pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod exists. - Normally this should not be necessary, - but it may be useful when manually reconstructing - a broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels and - annotations that will be copied - into the PVC when creating it. No - other fields are allowed and will - be rejected during validation. - type: object - spec: - description: The specification for - the PersistentVolumeClaim. The entire - content is copied unchanged into - the PVC that gets created from this - template. The same fields as in - a PersistentVolumeClaim are also - valid here. - properties: - accessModes: - description: 'accessModes contains - the desired access modes the - volume should have. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create - a new volume based on the contents - of the specified data source. - If the AnyVolumeDataSource feature - gate is enabled, this field - will always have the same contents - as the DataSourceRef field.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may - be any local object from a non-empty - API group (non core object) - or a PersistentVolumeClaim object. - When this field is specified, - volume binding will only succeed - if the type of the specified - object matches some installed - volume populator or dynamic - provisioner. This field will - replace the functionality of - the DataSource field and as - such if both fields are non-empty, - they must have the same value. - For backwards compatibility, - both fields (DataSource and - DataSourceRef) will be set to - the same value automatically - if one of them is empty and - the other is non-empty. There - are two important differences - between DataSource and DataSourceRef: - * While DataSource only allows - two specific types of objects, - DataSourceRef allows any non-core - object, as well as PersistentVolumeClaim - objects. * While DataSource - ignores disallowed values (dropping - them), DataSourceRef preserves - all values, and generates an - error if a disallowed value - is specified. (Beta) Using - this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the volume - should have. If RecoverVolumeExpansionFailure - feature is enabled users are - allowed to specify resource - requirements that are lower - than previous value but must - still be higher than capacity - recorded in the status field - of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of compute - resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, - it defaults to Limits if - that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label - query over volumes to consider - for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is the - binding reference to the PersistentVolume - backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel - resource that is attached to a kubelet's - host machine and then exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target - lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: - FC target worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs and - lun must be set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. - properties: - driver: - description: driver is the name of the - driver to use for this volume. - type: string - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The - default filesystem depends on FlexVolume - script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this - field holds extra command options if - any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the - plugin scripts. This may be empty if - no secret object is specified. If the - secret object contains more than one - secret, all secrets are passed to the - plugin scripts.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker - volume attached to a kubelet's host machine. - This depends on the Flocker control service - being running - properties: - datasetName: - description: datasetName is Name of the - dataset stored as metadata -> name on - the dataset for Flocker should be considered - as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of - the dataset. This is unique identifier - of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type - of the volume that you want to mount. - Tip: Ensure that the filesystem type - is supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of - the PD resource in GCE. Used to identify - the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container - with a git repo, mount an EmptyDir into - an InitContainer that clones the repo using - git, then mount the EmptyDir into the Pod''s - container.' - properties: - directory: - description: directory is the target directory - name. Must not contain or start with - '..'. If '.' is supplied, the volume - directory will be the git repository. Otherwise, - if specified, the volume will contain - the git repository in the subdirectory - with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash - for the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume - path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted with - read-only permissions. Defaults to false. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that - is directly exposed to the container. This - is generally used for system agents or other - privileged things that are allowed to see - the host machine. Most containers will NOT - need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who - can use host directory mounts and who can/can - not mount host directories as read/write.' - properties: - path: - description: 'path of the directory on - the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk - resource that is attached to a kubelet''s - host machine and then exposed to the pod. - More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines - whether support iSCSI Discovery CHAP - authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether - support iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom - iSCSI Initiator Name. If initiatorName - is specified with iscsiInterface simultaneously, - new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified - Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target - Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target - Portal List. The portal is either an - IP or ip_addr:port if the port is other - than default (typically TCP ports 860 - and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret - for iSCSI target and initiator authentication - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target - Portal. The Portal is either an IP or - ip_addr:port if the port is other than - default (typically TCP ports 860 and - 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be - a DNS_LABEL and unique within the pod. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force - the NFS export to be mounted with read-only - permissions. Defaults to false. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or - IP address of the NFS server. More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of - a PersistentVolumeClaim in the same - namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents - a PhotonController persistent disk attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one - resources secrets, configmaps, and downward - API - properties: - defaultMode: - description: defaultMode are the mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both - octal and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume - projections - items: - description: Projection that may be - projected along with other supported - volume types - properties: - configMap: - description: configMap information - about the configMap data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - ConfigMap will be projected - into the volume as a file - whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - ConfigMap, the volume setup - will error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional specify - whether the ConfigMap or its - keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data to - project - properties: - items: - description: Items is a list - of DownwardAPIVolume file - items: - description: DownwardAPIVolumeFile - represents information to - create the file containing - the pod field - properties: - fieldRef: - description: 'Required: - Selects a field of the - pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version - of the schema the - FieldPath is written - in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path - of the field to - select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: - mode bits used to set - permissions on this - file, must be an octal - value between 0000 and - 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and - decimal values, JSON - requires decimal values - for mode bits. If not - specified, the volume - defaultMode will be - used. This might be - in conflict with other - options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: - Path is the relative - path name of the file - to be created. Must - not be absolute or contain - the ''..'' path. Must - be utf-8 encoded. The - first item of the relative - path must not start - with ''..''' - type: string - resourceFieldRef: - description: 'Selects - a resource of the container: - only resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for - volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format - of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information - about the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - Secret will be projected into - the volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - Secret, the volume setup will - error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional field - specify whether the Secret - or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken - is information about the serviceAccountToken - data to project - properties: - audience: - description: audience is the - intended audience of the token. - A recipient of a token must - identify itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. The - audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the token - approaches expiration, the - kubelet volume plugin will - proactively rotate the service - account token. The kubelet - will start trying to rotate - the token if the token is - older than 80 percent of its - time to live or if the token - is older than 24 hours.Defaults - to 1 hour and must be at least - 10 minutes. - format: int64 - type: integer - path: - description: path is the path - relative to the mount point - of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte - mount on the host that shares a pod's lifetime - properties: - group: - description: group to map volume access - to Default is no group - type: string - readOnly: - description: readOnly here will force - the Quobyte volume to be mounted with - read-only permissions. Defaults to false. - type: boolean - registry: - description: registry represents a single - or multiple Quobyte Registry services - specified as a string as host:port pair - (multiple entries are separated with - commas) which acts as the central registry - for volumes - type: string - tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is - set by the plugin - type: string - user: - description: user to map volume access - to Defaults to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by - name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key - ring for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. - Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the - authentication secret for RBDUser. If - provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. - Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO - persistent volume attached and mounted on - Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default - is "xfs". - type: string - gateway: - description: gateway is the host address - of the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name - of the ScaleIO Protection Domain for - the configured storage. - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the - secret for ScaleIO user and other sensitive - information. If this is not provided, - Login operation will fail. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, default - false - type: boolean - storageMode: - description: storageMode indicates whether - the storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO - Storage Pool associated with the protection - domain. - type: string - system: - description: system is the name of the - storage system as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of - a volume already created in the ScaleIO - system that is associated with this - volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that - should populate this volume. More info: - https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether - the Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of - the secret in the pod''s namespace to - use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes - nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API - credentials. If not specified, default - values will be attempted. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume - names are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the Pod's - namespace will be used. This allows - the Kubernetes name scoping to be mirrored - within StorageOS for tighter integration. - Set VolumeName to any name to override - the default behaviour. Set to "default" - if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist - within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fsType is filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage - Policy Based Management (SPBM) profile - ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the - storage Policy Based Management (SPBM) - profile name. - type: string - volumePath: - description: volumePath is the path that - identifies vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces are the volumes that this - Task requires. - items: - description: WorkspaceDeclaration is a declaration - of a volume that a Task requires. - properties: - description: - description: Description is an optional human - readable description of this volume. - type: string - mountPath: - description: MountPath overrides the directory - that the volume will be made available at. - type: string - name: - description: Name is the name by which you - can bind the volume at runtime. - type: string - optional: - description: Optional marks a Workspace as - not being required in TaskRuns. By default - this field is false and so declared workspaces - are required. - type: boolean - readOnly: - description: ReadOnly dictates whether a mounted - volume is writable. By default this field - is false and so mounted volumes are writable. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - timeout: - description: 'Time after which the TaskRun times out. - Defaults to 1 hour. Specified TaskRun timeout should - be less than 24h. Refer Go''s ParseDuration documentation - for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - when: - description: WhenExpressions is a list of when expressions - that need to be true for the task to run - items: - description: WhenExpression allows a PipelineTask - to declare expressions to be evaluated before the - Task is run to determine whether the Task should - be executed or skipped - properties: - input: - description: Input is the string for guard checking - which can be a static input or an output from - a parent Task - type: string - operator: - description: Operator that represents an Input's - relationship to the values - type: string - values: - description: Values is an array of strings, which - is compared against the input, for guard checking - It must be non-empty - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - input - - operator - - values - type: object - type: array - workspaces: - description: Workspaces maps workspaces from the pipeline - spec to the workspaces declared in the Task. - items: - description: WorkspacePipelineTaskBinding describes - how a workspace passed into the pipeline should - be mapped to a task's declared workspace. - properties: - name: - description: Name is the name of the workspace - as declared by the task - type: string - subPath: - description: SubPath is optionally a directory - on the volume which should be used for this - binding (i.e. the volume will be mounted at - this sub directory). - type: string - workspace: - description: Workspace is the name of the workspace - declared by the pipeline - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces declares a set of named workspaces - that are expected to be provided by a PipelineRun. - items: - description: PipelineWorkspaceDeclaration creates a named - slot in a Pipeline that a PipelineRun is expected to populate - with a workspace binding. - properties: - description: - description: Description is a human readable string - describing how the workspace will be used in the Pipeline. - It can be useful to include a bit of detail about - which tasks are intended to have access to the data - on the workspace. - type: string - name: - description: Name is the name of a workspace to be provided - by a PipelineRun. - type: string - optional: - description: Optional marks a Workspace as not being - required in PipelineRuns. By default this field is - false and so declared workspaces are required. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podTemplate: - description: PodTemplate holds pod specific configuration - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules - for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose a node - that violates one or more of the expressions. The - node that is most preferred is the one with the - greatest sum of weights, i.e. for each node that - meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements - of this field and adding "weight" to the sum if - the node matches the corresponding matchExpressions; - the node(s) with the highest sum are the most preferred. - items: - description: An empty preferred scheduling term - matches all objects with implicit weight 0 (i.e. - it's a no-op). A null preferred scheduling term - matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated - with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, the - values array must have a single - element, which will be interpreted - as an integer. This array is replaced - during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, the - values array must have a single - element, which will be interpreted - as an integer. This array is replaced - during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - weight: - description: Weight associated with matching - the corresponding nodeSelectorTerm, in the - range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, the - pod will not be scheduled onto the node. If the - affinity requirements specified by this field cease - to be met at some point during pod execution (e.g. - due to an update), the system may or may not try - to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector - terms. The terms are ORed. - items: - description: A null or empty node selector term - matches no objects. The requirements of them - are ANDed. The TopologySelectorTerm type implements - a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, the - values array must have a single - element, which will be interpreted - as an integer. This array is replaced - during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that the - selector applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, the - values array must have a single - element, which will be interpreted - as an integer. This array is replaced - during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - type: array - required: - - nodeSelectorTerms - type: object - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. - co-locate this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose a node - that violates one or more of the expressions. The - node that is most preferred is the one with the - greatest sum of weights, i.e. for each node that - meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, - etc.), compute a sum by iterating through the elements - of this field and adding "weight" to the sum if - the node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest sum - are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, - associated with the corresponding weight. - properties: - labelSelector: - description: A label query over a set of - resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies to. - The term is applied to the union of the - namespaces selected by this field and - the ones listed in the namespaces field. - null selector and null or empty namespaces - list means "this pod's namespace". An - empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in the - range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, the - pod will not be scheduled onto the node. If the - affinity requirements specified by this field cease - to be met at some point during pod execution (e.g. - due to a pod label update), the system may or may - not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes - corresponding to each podAffinityTerm are intersected, - i.e. all terms must be satisfied. - items: - description: Defines a set of pods (namely those - matching the labelSelector relative to the given - namespace(s)) that this pod should be co-located - (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node - whose value of the label with key - matches that of any node on which a pod of the - set of pods is running - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by - this field and the ones listed in the namespaces - field. null selector and null or empty namespaces - list means "this pod's namespace". An empty - selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. - The term is applied to the union of the namespaces - listed in this field and the ones selected - by namespaceSelector. null or empty namespaces - list and null namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the - pods matching the labelSelector in the specified - namespaces, where co-located is defined as - running on a node whose value of the label - with key topologyKey matches that of any node - on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules - (e.g. avoid putting this pod in the same node, zone, - etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the anti-affinity expressions - specified by this field, but it may choose a node - that violates one or more of the expressions. The - node that is most preferred is the one with the - greatest sum of weights, i.e. for each node that - meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity - expressions, etc.), compute a sum by iterating through - the elements of this field and adding "weight" to - the sum if the node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest sum - are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, - associated with the corresponding weight. - properties: - labelSelector: - description: A label query over a set of - resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies to. - The term is applied to the union of the - namespaces selected by this field and - the ones listed in the namespaces field. - null selector and null or empty namespaces - list means "this pod's namespace". An - empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in the - range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified - by this field are not met at scheduling time, the - pod will not be scheduled onto the node. If the - anti-affinity requirements specified by this field - cease to be met at some point during pod execution - (e.g. due to a pod label update), the system may - or may not try to eventually evict the pod from - its node. When there are multiple elements, the - lists of nodes corresponding to each podAffinityTerm - are intersected, i.e. all terms must be satisfied. - items: - description: Defines a set of pods (namely those - matching the labelSelector relative to the given - namespace(s)) that this pod should be co-located - (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node - whose value of the label with key - matches that of any node on which a pod of the - set of pods is running - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by - this field and the ones listed in the namespaces - field. null selector and null or empty namespaces - list means "this pod's namespace". An empty - selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. - The term is applied to the union of the namespaces - listed in this field and the ones selected - by namespaceSelector. null or empty namespaces - list and null namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the - pods matching the labelSelector in the specified - namespaces, where co-located is defined as - running on a node whose value of the label - with key topologyKey matches that of any node - on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether - pods running as this service account should have an API - token automatically mounted. - type: boolean - dnsConfig: - description: Specifies the DNS parameters of a pod. Parameters - specified here will be merged to the generated DNS configuration - based on DNSPolicy. - properties: - nameservers: - description: A list of DNS name server IP addresses. This - will be appended to the base nameservers generated from - DNSPolicy. Duplicated nameservers will be removed. - items: - type: string - type: array - options: - description: A list of DNS resolver options. This will - be merged with the base options generated from DNSPolicy. - Duplicated entries will be removed. Resolution options - given in Options will override those that appear in - the base DNSPolicy. - items: - description: PodDNSConfigOption defines DNS resolver - options of a pod. - properties: - name: - description: Required. - type: string - value: - type: string - type: object - type: array - searches: - description: A list of DNS search domains for host-name - lookup. This will be appended to the base search paths - generated from DNSPolicy. Duplicated search paths will - be removed. - items: - type: string - type: array - type: object - dnsPolicy: - description: Set DNS policy for the pod. Defaults to "ClusterFirst". - Valid values are 'ClusterFirst', 'Default' or 'None'. DNS - parameters given in DNSConfig will be merged with the policy - selected with DNSPolicy. - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information - about services should be injected into pod''s environment - variables, matching the syntax of Docker links. Optional: - Defaults to true.' - type: boolean - env: - description: List of environment variables that can be provided - to the containers belonging to the pod. - items: - description: EnvVar represents an environment variable present - in a Container. - properties: - name: - description: Name of the environment variable. Must - be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are expanded - using the previously defined environment variables - in the container and any service environment variables. - If a variable cannot be resolved, the reference in - the input string will be unchanged. Double $$ are - reduced to a single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". Escaped references - will never be expanded, regardless of whether the - variable exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's value. - Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap or - its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports - metadata.name, metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, spec.nodeName, - spec.serviceAccountName, status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the pod's - namespace - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret or its - key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - hostAliases: - description: HostAliases is an optional list of hosts and - IPs that will be injected into the pod's hosts file if specified. - This is only valid for non-hostNetwork pods. - items: - description: HostAlias holds the mapping between IP and - hostnames that will be injected as an entry in the pod's - hosts file. - properties: - hostnames: - description: Hostnames for the above IP address. - items: - type: string - type: array - ip: - description: IP address of the host file entry. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - hostNetwork: - description: HostNetwork specifies whether the pod may use - the node network namespace - type: boolean - imagePullSecrets: - description: ImagePullSecrets gives the name of the secret - used by the pod to pull the image if specified - items: - description: LocalObjectReference contains enough information - to let you locate the referenced object inside the same - namespace. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - type: object - type: array - x-kubernetes-list-type: atomic - nodeSelector: - additionalProperties: - type: string - description: 'NodeSelector is a selector which must be true - for the pod to fit on a node. Selector which must match - a node''s labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - priorityClassName: - description: If specified, indicates the pod's priority. "system-node-critical" - and "system-cluster-critical" are two special keywords which - indicate the highest priorities with the former being the - highest priority. Any other name must be defined by creating - a PriorityClass object with that name. If not specified, - the pod priority will be default or zero if there is no - default. - type: string - runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass object - in the node.k8s.io group, which should be used to run this - pod. If no RuntimeClass resource matches the named class, - the pod will not be run. If unset or empty, the "legacy" - RuntimeClass will be used, which is an implicit class with - an empty definition that uses the default runtime handler. - More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md - This is a beta feature as of Kubernetes v1.14.' - type: string - schedulerName: - description: SchedulerName specifies the scheduler to be used - to dispatch the Pod - type: string - securityContext: - description: 'SecurityContext holds pod-level security attributes - and common container settings. Optional: Defaults to empty. See - type description for default values of each field.' - properties: - fsGroup: - description: "A special supplemental group that applies - to all containers in a pod. Some volume types allow - the Kubelet to change the ownership of that volume to - be owned by the pod: \n 1. The owning GID will be the - FSGroup 2. The setgid bit is set (new files created - in the volume will be owned by FSGroup) 3. The permission - bits are OR'd with rw-rw---- \n If unset, the Kubelet - will not modify the ownership and permissions of any - volume. Note that this field cannot be set when spec.os.name - is windows." - format: int64 - type: integer - fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior of - changing ownership and permission of the volume before - being exposed inside Pod. This field will only apply - to volume types which support fsGroup based ownership(and - permissions). It will have no effect on ephemeral volume - types such as: secret, configmaps and emptydir. Valid - values are "OnRootMismatch" and "Always". If not specified, - "Always" is used. Note that this field cannot be set - when spec.os.name is windows.' - type: string - runAsGroup: - description: The GID to run the entrypoint of the container - process. Uses runtime default if unset. May also be - set in SecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. Note that this - field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run as - a non-root user. If true, the Kubelet will validate - the image at runtime to ensure that it does not run - as UID 0 (root) and fail to start the container if it - does. If unset or false, no such validation will be - performed. May also be set in SecurityContext. If set - in both SecurityContext and PodSecurityContext, the - value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the container - process. Defaults to user specified in image metadata - if unspecified. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence - for that container. Note that this field cannot be set - when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to all - containers. If unspecified, the container runtime will - allocate a random SELinux context for each container. May - also be set in SecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. Note that this - field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by the containers - in this pod. Note that this field cannot be set when - spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. The - profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's - configured seccomp profile location. Must only be - set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: \n Localhost - - a profile defined in a file on the node should - be used. RuntimeDefault - the container runtime - default profile should be used. Unconfined - no - profile should be applied." - type: string - required: - - type - type: object - supplementalGroups: - description: A list of groups applied to the first process - run in each container, in addition to the container's - primary GID. If unspecified, no groups will be added - to any container. Note that this field cannot be set - when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - sysctls: - description: Sysctls hold a list of namespaced sysctls - used for the pod. Pods with unsupported sysctls (by - the container runtime) might fail to launch. Note that - this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be - set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - windowsOptions: - description: The Windows specific settings applied to - all containers. If unspecified, the options within a - container's SecurityContext will be used. If set in - both SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA - admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential spec - named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of - the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. This - field is alpha-level and will only be honored by - components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the feature - flag will result in errors when validating the Pod. - All of a Pod's containers must have the same effective - HostProcess value (it is not allowed to have a mix - of HostProcess containers and non-HostProcess containers). In - addition, if HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the entrypoint - of the container process. Defaults to the user specified - in image metadata if unspecified. May also be set - in PodSecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - tolerations: - description: If specified, the pod's tolerations. - items: - description: The pod this Toleration is attached to tolerates - any taint that matches the triple using - the matching operator . - properties: - effect: - description: Effect indicates the taint effect to match. - Empty means match all taint effects. When specified, - allowed values are NoSchedule, PreferNoSchedule and - NoExecute. - type: string - key: - description: Key is the taint key that the toleration - applies to. Empty means match all taint keys. If the - key is empty, operator must be Exists; this combination - means to match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists and Equal. - Defaults to Equal. Exists is equivalent to wildcard - for value, so that a pod can tolerate all taints of - a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period - of time the toleration (which must be of effect NoExecute, - otherwise this field is ignored) tolerates the taint. - By default, it is not set, which means tolerate the - taint forever (do not evict). Zero and negative values - will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration - matches to. If the operator is Exists, the value should - be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - topologySpreadConstraints: - description: TopologySpreadConstraints controls how Pods are - spread across your cluster among failure-domains such as - regions, zones, nodes, and other user-defined topology domains. - items: - description: TopologySpreadConstraint specifies how to spread - matching pods among the given topology. - properties: - labelSelector: - description: LabelSelector is used to find matching - pods. Pods that match this label selector are counted - to determine the number of pods in their corresponding - topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are ANDed. - items: - description: A label selector requirement is a - selector that contains values, a key, and an - operator that relates the key and values. - properties: - key: - description: key is the label key that the - selector applies to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. If the - operator is Exists or DoesNotExist, the - values array must be empty. This array is - replaced during a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is "In", - and the values array contains only "value". The - requirements are ANDed. - type: object - type: object - matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys - to select the pods over which spreading will be calculated. - The keys are used to lookup values from the incoming - pod labels, those key-value labels are ANDed with - labelSelector to select the group of existing pods - over which spreading will be calculated for the incoming - pod. Keys that don't exist in the incoming pod labels - will be ignored. A null or empty list means only match - against labelSelector. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: 'MaxSkew describes the degree to which - pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, - it is the maximum permitted difference between the - number of matching pods in the target topology and - the global minimum. The global minimum is the minimum - number of matching pods in an eligible domain or zero - if the number of eligible domains is less than MinDomains. - For example, in a 3-zone cluster, MaxSkew is set to - 1, and pods with the same labelSelector spread as - 2/2/1: In this case, the global minimum is 1. | zone1 - | zone2 | zone3 | | P P | P P | P | - if MaxSkew - is 1, incoming pod can only be scheduled to zone3 - to become 2/2/2; scheduling it onto zone1(zone2) would - make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - - if MaxSkew is 2, incoming pod can be scheduled onto - any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to topologies - that satisfy it. It''s a required field. Default value - is 1 and 0 is not allowed.' - format: int32 - type: integer - minDomains: - description: "MinDomains indicates a minimum number - of eligible domains. When the number of eligible domains - with matching topology keys is less than minDomains, - Pod Topology Spread treats \"global minimum\" as 0, - and then the calculation of Skew is performed. And - when the number of eligible domains with matching - topology keys equals or greater than minDomains, this - value has no effect on scheduling. As a result, when - the number of eligible domains is less than minDomains, - scheduler won't schedule more than maxSkew Pods to - those domains. If value is nil, the constraint behaves - as if MinDomains is equal to 1. Valid values are integers - greater than 0. When value is not nil, WhenUnsatisfiable - must be DoNotSchedule. \n For example, in a 3-zone - cluster, MaxSkew is set to 2, MinDomains is set to - 5 and pods with the same labelSelector spread as 2/2/2: - | zone1 | zone2 | zone3 | | P P | P P | P P | - The number of domains is less than 5(MinDomains), - so \"global minimum\" is treated as 0. In this situation, - new pod with the same labelSelector cannot be scheduled, - because computed skew will be 3(3 - 0) if new Pod - is scheduled to any of the three zones, it will violate - MaxSkew. \n This is a beta field and requires the - MinDomainsInPodTopologySpread feature gate to be enabled - (enabled by default)." - format: int32 - type: integer - nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates how we will - treat Pod's nodeAffinity/nodeSelector when calculating - pod topology spread skew. Options are: - Honor: only - nodes matching nodeAffinity/nodeSelector are included - in the calculations. - Ignore: nodeAffinity/nodeSelector - are ignored. All nodes are included in the calculations. - \n If this value is nil, the behavior is equivalent - to the Honor policy. This is a alpha-level feature - enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how we will - treat node taints when calculating pod topology spread - skew. Options are: - Honor: nodes without taints, - along with tainted nodes for which the incoming pod - has a toleration, are included. - Ignore: node taints - are ignored. All nodes are included. \n If this value - is nil, the behavior is equivalent to the Ignore policy. - This is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - topologyKey: - description: TopologyKey is the key of node labels. - Nodes that have a label with this key and identical - values are considered to be in the same topology. - We consider each as a "bucket", and try - to put balanced number of pods into each bucket. We - define a domain as a particular instance of a topology. - Also, we define an eligible domain as a domain whose - nodes meet the requirements of nodeAffinityPolicy - and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", - each Node is a domain of that topology. And, if TopologyKey - is "topology.kubernetes.io/zone", each zone is a domain - of that topology. It's a required field. - type: string - whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates how to deal - with a pod if it doesn''t satisfy the spread constraint. - - DoNotSchedule (default) tells the scheduler not - to schedule it. - ScheduleAnyway tells the scheduler - to schedule the pod in any location, but giving - higher precedence to topologies that would help reduce - the skew. A constraint is considered "Unsatisfiable" - for an incoming pod if and only if every possible - node assignment for that pod would violate "MaxSkew" - on some topology. For example, in a 3-zone cluster, - MaxSkew is set to 1, and pods with the same labelSelector - spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P - | P | P | If WhenUnsatisfiable is set to DoNotSchedule, - incoming pod can only be scheduled to zone2(zone3) - to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) - satisfies MaxSkew(1). In other words, the cluster - can still be imbalanced, but scheduler won''t make - it *more* imbalanced. It''s a required field.' - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: 'List of volumes that can be mounted by containers - belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' - items: - description: Volume represents a named volume in a pod that - may be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents an AWS - Disk resource that is attached to a kubelet''s host - machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem type of the - volume that you want to mount. Tip: Ensure that - the filesystem type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in the - volume that you want to mount. If omitted, the - default is to mount by volume name. Examples: - For volume /dev/sda1, you specify the partition - as "1". Similarly, the volume partition for /dev/sda - is "0" (or you can leave the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will force the - readOnly setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of the persistent - disk resource in AWS (Amazon EBS volume). More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure Data Disk - mount on the host and bind mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host Caching mode: - None, Read Only, Read Write.' - type: string - diskName: - description: diskName is the Name of the data disk - in the blob storage - type: string - diskURI: - description: diskURI is the URI of data disk in - the blob storage - type: string - fsType: - description: fsType is Filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are Shared: multiple - blob disks per storage account Dedicated: single - blob disk per storage account Managed: azure - managed data disk (only in managed availability - set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure File Service - mount on the host and bind mount to the pod. - properties: - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of secret that - contains Azure Storage Account Name and Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount on the - host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors is - a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as the mounted - root, rather than the full Ceph tree, default - is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults to - false (read/write). ReadOnly here will force the - ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: SecretFile - is the path to key ring for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef is - reference to the authentication secret for User, - default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is the rados - user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume attached - and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if unspecified. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points to a - secret object containing parameters used to connect - to OpenStack.' - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify the volume - in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap that should - populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: mode bits - used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. Directories - within the path are not affected by this setting. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced ConfigMap - will be projected into the volume as a file whose - name is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. - If a key is specified which is not present in - the ConfigMap, the volume setup will error unless - it is marked optional. Paths must be relative - and may not contain the '..' path or start with - '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. Must - be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON - requires decimal values for mode bits. If - not specified, the volume defaultMode will - be used. This might be in conflict with - other options that affect the file mode, - like fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path of - the file to map the key to. May not be an - absolute path. May not contain the path - element '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the CSI driver - that handles this volume. Consult with your admin - for the correct name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", - "ntfs". If not provided, the empty value is passed - to the associated CSI driver which will determine - the default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference - to the secret object containing sensitive information - to pass to the CSI driver to complete the CSI - NodePublishVolume and NodeUnpublishVolume calls. - This field is optional, and may be empty if no - secret is required. If the secret object contains - more than one secret, all secret references are - passed. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. - Consult your driver's documentation for supported - values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward API about - the pod that should populate this volume - properties: - defaultMode: - description: 'Optional: mode bits to use on created - files by default. Must be a Optional: mode bits - used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. Directories - within the path are not affected by this setting. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward API volume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing the - pod field - properties: - fieldRef: - description: 'Required: Selects a field of - the pod: only annotations, labels, name - and namespace are supported.' - properties: - apiVersion: - description: Version of the schema the - FieldPath is written in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path of the field to select - in the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used to - set permissions on this file, must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both - octal and decimal values, JSON requires - decimal values for mode bits. If not specified, - the volume defaultMode will be used. This - might be in conflict with other options - that affect the file mode, like fsGroup, - and the result can be other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path is the relative - path name of the file to be created. Must - not be absolute or contain the ''..'' path. - Must be utf-8 encoded. The first item of - the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format - of the exposed resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary directory - that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type of storage - medium should back this directory. The default - is "" which means to use the node''s default medium. - Must be an empty string (default) or Memory. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount of local - storage required for this EmptyDir volume. The - size limit is also applicable for memory medium. - The maximum usage on memory medium EmptyDir would - be the minimum value between the SizeLimit specified - here and the sum of memory limits of all containers - in a pod. The default is nil which means that - the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume that is - handled by a cluster storage driver. The volume's - lifecycle is tied to the pod that defines it - it - will be created before the pod starts, and deleted - when the pod is removed. \n Use this if: a) the volume - is only needed while the pod runs, b) features of - normal volumes like restoring from snapshot or capacity - \ tracking are needed, c) the storage driver is - specified through a storage class, and d) the storage - driver supports dynamic volume provisioning through - \ a PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection between - this volume type and PersistentVolumeClaim). \n - Use PersistentVolumeClaim or one of the vendor-specific - APIs for volumes that persist for longer than the - lifecycle of an individual pod. \n Use CSI for light-weight - local ephemeral volumes if the CSI driver is meant - to be used that way - see the documentation of the - driver for more information. \n A pod can use both - types of ephemeral volumes and persistent volumes - at the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a stand-alone - PVC to provision the volume. The pod in which - this EphemeralVolumeSource is embedded will be - the owner of the PVC, i.e. the PVC will be deleted - together with the pod. The name of the PVC will - be `-` where `` - is the name from the `PodSpec.Volumes` array entry. - Pod validation will reject the pod if the concatenated - name is not valid for a PVC (for example, too - long). \n An existing PVC with that name that - is not owned by the pod will *not* be used for - the pod to avoid using an unrelated volume by - mistake. Starting the pod is then blocked until - the unrelated PVC is removed. If such a pre-created - PVC is meant to be used by the pod, the PVC has - to updated with an owner reference to the pod - once the pod exists. Normally this should not - be necessary, but it may be useful when manually - reconstructing a broken cluster. \n This field - is read-only and no changes will be made by Kubernetes - to the PVC after it has been created. \n Required, - must not be nil." - properties: - metadata: - description: May contain labels and annotations - that will be copied into the PVC when creating - it. No other fields are allowed and will be - rejected during validation. - type: object - spec: - description: The specification for the PersistentVolumeClaim. - The entire content is copied unchanged into - the PVC that gets created from this template. - The same fields as in a PersistentVolumeClaim - are also valid here. - properties: - accessModes: - description: 'accessModes contains the desired - access modes the volume should have. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be used - to specify either: * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external controller - can support the specified data source, - it will create a new volume based on the - contents of the specified data source. - If the AnyVolumeDataSource feature gate - is enabled, this field will always have - the same contents as the DataSourceRef - field.' - properties: - apiGroup: - description: APIGroup is the group for - the resource being referenced. If - APIGroup is not specified, the specified - Kind must be in the core API group. - For any other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies the - object from which to populate the volume - with data, if a non-empty volume is desired. - This may be any local object from a non-empty - API group (non core object) or a PersistentVolumeClaim - object. When this field is specified, - volume binding will only succeed if the - type of the specified object matches some - installed volume populator or dynamic - provisioner. This field will replace the - functionality of the DataSource field - and as such if both fields are non-empty, - they must have the same value. For backwards - compatibility, both fields (DataSource - and DataSourceRef) will be set to the - same value automatically if one of them - is empty and the other is non-empty. There - are two important differences between - DataSource and DataSourceRef: * While - DataSource only allows two specific types - of objects, DataSourceRef allows any - non-core object, as well as PersistentVolumeClaim - objects. * While DataSource ignores disallowed - values (dropping them), DataSourceRef preserves - all values, and generates an error if - a disallowed value is specified. (Beta) - Using this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the group for - the resource being referenced. If - APIGroup is not specified, the specified - Kind must be in the core API group. - For any other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the minimum - resources the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to - specify resource requirements that are - lower than previous value but must still - be higher than capacity recorded in the - status field of the claim. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted for - a container, it defaults to Limits - if that is explicitly specified, otherwise - to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query over - volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is the name - of the StorageClass required by the claim. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what type - of volume is required by the claim. Value - of Filesystem is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is the binding reference - to the PersistentVolume backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel resource - that is attached to a kubelet's host machine and then - exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. TODO: how - do we prevent errors in the filesystem from compromising - the machine' - type: string - lun: - description: 'lun is Optional: FC target lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults to - false (read/write). ReadOnly here will force the - ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: FC target - worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume world wide - identifiers (wwids) Either wwids or combination - of targetWWNs and lun must be set, but not both - simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic volume - resource that is provisioned/attached using an exec - based plugin. - properties: - driver: - description: driver is the name of the driver to - use for this volume. - type: string - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". The - default filesystem depends on FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this field holds - extra command options if any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults to - false (read/write). ReadOnly here will force the - ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef is - reference to the secret object containing sensitive - information to pass to the plugin scripts. This - may be empty if no secret object is specified. - If the secret object contains more than one secret, - all secrets are passed to the plugin scripts.' - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker volume attached - to a kubelet's host machine. This depends on the Flocker - control service being running - properties: - datasetName: - description: datasetName is Name of the dataset - stored as metadata -> name on the dataset for - Flocker should be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of the dataset. - This is unique identifier of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents a GCE Disk - resource that is attached to a kubelet''s host machine - and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in the - volume that you want to mount. If omitted, the - default is to mount by volume name. Examples: - For volume /dev/sda1, you specify the partition - as "1". Similarly, the volume partition for /dev/sda - is "0" (or you can leave the property empty). - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of the PD resource - in GCE. Used to identify the disk in GCE. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository at - a particular revision. DEPRECATED: GitRepo is deprecated. - To provision a container with a git repo, mount an - EmptyDir into an InitContainer that clones the repo - using git, then mount the EmptyDir into the Pod''s - container.' - properties: - directory: - description: directory is the target directory name. - Must not contain or start with '..'. If '.' is - supplied, the volume directory will be the git - repository. Otherwise, if specified, the volume - will contain the git repository in the subdirectory - with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash for the - specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs mount - on the host that shares a pod''s lifetime. More info: - https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint name that - details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume path. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force the Glusterfs - volume to be mounted with read-only permissions. - Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing file - or directory on the host machine that is directly - exposed to the container. This is generally used for - system agents or other privileged things that are - allowed to see the host machine. Most containers will - NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can use - host directory mounts and who can/can not mount host - directories as read/write.' - properties: - path: - description: 'path of the directory on the host. - If the path is a symlink, it will follow the link - to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume Defaults - to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk resource - that is attached to a kubelet''s host machine and - then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines whether support - iSCSI Discovery CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether support - iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem type of the - volume that you want to mount. Tip: Ensure that - the filesystem type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom iSCSI Initiator - Name. If initiatorName is specified with iscsiInterface - simultaneously, new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface Name - that uses an iSCSI transport. Defaults to 'default' - (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target Portal - List. The portal is either an IP or ip_addr:port - if the port is other than default (typically TCP - ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret for iSCSI - target and initiator authentication - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target Portal. - The Portal is either an IP or ip_addr:port if - the port is other than default (typically TCP - ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be a DNS_LABEL - and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount on the host - that shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by the NFS server. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force the NFS export - to be mounted with read-only permissions. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or IP address - of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource represents - a reference to a PersistentVolumeClaim in the same - namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly setting - in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets host - machine - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies Photon - Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx volume - attached and mounted on kubelets host machine - properties: - fsType: - description: fSType represents the filesystem type - to mount Must be a filesystem type supported by - the host operating system. Ex. "ext4", "xfs". - Implicitly inferred to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a Portworx - volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one resources - secrets, configmaps, and downward API - properties: - defaultMode: - description: defaultMode are the mode bits used - to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Directories within the path - are not affected by this setting. This might be - in conflict with other options that affect the - file mode, like fsGroup, and the result can be - other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected - along with other supported volume types - properties: - configMap: - description: configMap information about the - configMap data to project - properties: - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information about - the downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace are - supported.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file - to be created. Must not be absolute - or contain the ''..'' path. Must - be utf-8 encoded. The first item - of the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about the - secret data to project - properties: - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: audience is the intended - audience of the token. A recipient of - a token must identify itself with an - identifier specified in the audience - of the token, and otherwise should reject - the token. The audience defaults to - the identifier of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is the - requested duration of validity of the - service account token. As the token - approaches expiration, the kubelet volume - plugin will proactively rotate the service - account token. The kubelet will start - trying to rotate the token if the token - is older than 80 percent of its time - to live or if the token is older than - 24 hours.Defaults to 1 hour and must - be at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative - to the mount point of the file to project - the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte mount on the - host that shares a pod's lifetime - properties: - group: - description: group to map volume access to Default - is no group - type: string - readOnly: - description: readOnly here will force the Quobyte - volume to be mounted with read-only permissions. - Defaults to false. - type: boolean - registry: - description: registry represents a single or multiple - Quobyte Registry services specified as a string - as host:port pair (multiple entries are separated - with commas) which acts as the central registry - for volumes - type: string - tenant: - description: tenant owning the given Quobyte volume - in the Backend Used with dynamically provisioned - Quobyte volumes, value is set by the plugin - type: string - user: - description: user to map volume access to Defaults - to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block Device mount - on the host that shares a pod''s lifetime. More info: - https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type of the - volume that you want to mount. Tip: Ensure that - the filesystem type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - image: - description: 'image is the rados image name. More - info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key ring for - RBDUser. Default is /etc/ceph/keyring. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection of Ceph monitors. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. Default - is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More - info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the authentication - secret for RBDUser. If provided overrides keyring. - Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. Default - is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO persistent - volume attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Default - is "xfs". - type: string - gateway: - description: gateway is the host address of the - ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name of the - ScaleIO Protection Domain for the configured storage. - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the secret - for ScaleIO user and other sensitive information. - If this is not provided, Login operation will - fail. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable SSL - communication with Gateway, default false - type: boolean - storageMode: - description: storageMode indicates whether the storage - for a volume should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO Storage - Pool associated with the protection domain. - type: string - system: - description: system is the name of the storage system - as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of a volume - already created in the ScaleIO system that is - associated with this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that should - populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: mode bits - used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. Directories - within the path are not affected by this setting. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value - pair in the Data field of the referenced Secret - will be projected into the volume as a file whose - name is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. - If a key is specified which is not present in - the Secret, the volume setup will error unless - it is marked optional. Paths must be relative - and may not contain the '..' path or start with - '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. Must - be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON - requires decimal values for mode bits. If - not specified, the volume defaultMode will - be used. This might be in conflict with - other options that affect the file mode, - like fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path of - the file to map the key to. May not be an - absolute path. May not contain the path - element '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether the - Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the secret - in the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret to use - for obtaining the StorageOS API credentials. If - not specified, default values will be attempted. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable name - of the StorageOS volume. Volume names are only - unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies the scope - of the volume within StorageOS. If no namespace - is specified then the Pod's namespace will be - used. This allows the Kubernetes name scoping - to be mirrored within StorageOS for tighter integration. - Set VolumeName to any name to override the default - behaviour. Set to "default" if you are not using - namespaces within StorageOS. Namespaces that do - not pre-exist within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere volume - attached and mounted on kubelets host machine - properties: - fsType: - description: fsType is filesystem type to mount. - Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage Policy - Based Management (SPBM) profile ID associated - with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the storage Policy - Based Management (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path that identifies - vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - resources: - description: Resources is a list of bindings specifying which - actual instances of PipelineResources to use for the resources - the Pipeline has declared it needs. - items: - description: PipelineResourceBinding connects a reference to - an instance of a PipelineResource with a PipelineResource - dependency that the Pipeline has declared - properties: - name: - description: Name is the name of the PipelineResource in - the Pipeline's declaration - type: string - resourceRef: - description: ResourceRef is a reference to the instance - of the actual PipelineResource that should be used - properties: - apiVersion: - description: API version of the referent - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - type: object - resourceSpec: - description: ResourceSpec is specification of a resource - that should be created and consumed by the task - properties: - description: - description: Description is a user-facing description - of the resource that may be used to populate a UI. - type: string - params: - items: - description: ResourceParam declares a string value - to use for the parameter called Name, and is used - in the specific context of PipelineResources. - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - secrets: - description: Secrets to fetch to populate some of resource - fields - items: - description: SecretParam indicates which secret can - be used to populate a field of the resource - properties: - fieldName: - type: string - secretKey: - type: string - secretName: - type: string - required: - - fieldName - - secretKey - - secretName - type: object - type: array - x-kubernetes-list-type: atomic - type: - type: string - required: - - params - - type - type: object - type: object - type: array - x-kubernetes-list-type: atomic - serviceAccountName: - type: string - status: - description: Used for cancelling a pipelinerun (and maybe more - later on) - type: string - taskRunSpecs: - description: TaskRunSpecs holds a set of runtime specs - items: - description: PipelineTaskRunSpec can be used to configure specific - specs for a concrete Task - properties: - computeResources: - description: Compute resources to use for this TaskRun - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of - compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is omitted - for a container, it defaults to Limits if that is - explicitly specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - metadata: - description: PipelineTaskMetadata contains the labels or - annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - pipelineTaskName: - type: string - sidecarOverrides: - items: - description: TaskRunSidecarOverride is used to override - the values of a Sidecar in the corresponding Task. - properties: - name: - description: The name of the Sidecar to override. - type: string - resources: - description: The resource requirements to apply to - the Sidecar. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is - omitted for a container, it defaults to Limits - if that is explicitly specified, otherwise to - an implementation-defined value. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - required: - - name - - resources - type: object - type: array - x-kubernetes-list-type: atomic - stepOverrides: - items: - description: TaskRunStepOverride is used to override the - values of a Step in the corresponding Task. - properties: - name: - description: The name of the Step to override. - type: string - resources: - description: The resource requirements to apply to - the Step. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is - omitted for a container, it defaults to Limits - if that is explicitly specified, otherwise to - an implementation-defined value. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - required: - - name - - resources - type: object - type: array - x-kubernetes-list-type: atomic - taskPodTemplate: - description: Template holds pod specific configuration - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling - rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose - a node that violates one or more of the expressions. - The node that is most preferred is the one - with the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum - by iterating through the elements of this - field and adding "weight" to the sum if the - node matches the corresponding matchExpressions; - the node(s) with the highest sum are the most - preferred. - items: - description: An empty preferred scheduling - term matches all objects with implicit weight - 0 (i.e. it's a no-op). A null preferred - scheduling term matches no objects (i.e. - is also a no-op). - properties: - preference: - description: A node selector term, associated - with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, - and Lt. - type: string - values: - description: An array of string - values. If the operator is - In or NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, - the values array must have - a single element, which will - be interpreted as an integer. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, - and Lt. - type: string - values: - description: An array of string - values. If the operator is - In or NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, - the values array must have - a single element, which will - be interpreted as an integer. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - weight: - description: Weight associated with matching - the corresponding nodeSelectorTerm, - in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, - the pod will not be scheduled onto the node. - If the affinity requirements specified by - this field cease to be met at some point during - pod execution (e.g. due to an update), the - system may or may not try to eventually evict - the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector - terms. The terms are ORed. - items: - description: A null or empty node selector - term matches no objects. The requirements - of them are ANDed. The TopologySelectorTerm - type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, - and Lt. - type: string - values: - description: An array of string - values. If the operator is - In or NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, - the values array must have - a single element, which will - be interpreted as an integer. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, - and Lt. - type: string - values: - description: An array of string - values. If the operator is - In or NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. - If the operator is Gt or Lt, - the values array must have - a single element, which will - be interpreted as an integer. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - type: array - required: - - nodeSelectorTerms - type: object - type: object - podAffinity: - description: Describes pod affinity scheduling rules - (e.g. co-locate this pod in the same node, zone, - etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose - a node that violates one or more of the expressions. - The node that is most preferred is the one - with the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum - by iterating through the elements of this - field and adding "weight" to the sum if the - node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest - sum are the most preferred. - items: - description: The weights of all of the matched - WeightedPodAffinityTerm fields are added - per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity - term, associated with the corresponding - weight. - properties: - labelSelector: - description: A label query over a - set of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in - the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, - the pod will not be scheduled onto the node. - If the affinity requirements specified by - this field cease to be met at some point during - pod execution (e.g. due to a pod label update), - the system may or may not try to eventually - evict the pod from its node. When there are - multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. - items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this pod - should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is - defined as running on a node whose value - of the label with key matches - that of any node on which a pod of the set - of pods is running - properties: - labelSelector: - description: A label query over a set - of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a - list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a - set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values - array must be non-empty. If - the operator is Exists or - DoesNotExist, the values array - must be empty. This array - is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies - to. The term is applied to the union - of the namespaces selected by this field - and the ones listed in the namespaces - field. null selector and null or empty - namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a - list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a - set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values - array must be non-empty. If - the operator is Exists or - DoesNotExist, the values array - must be empty. This array - is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling - rules (e.g. avoid putting this pod in the same - node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the anti-affinity - expressions specified by this field, but it - may choose a node that violates one or more - of the expressions. The node that is most - preferred is the one with the greatest sum - of weights, i.e. for each node that meets - all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity - expressions, etc.), compute a sum by iterating - through the elements of this field and adding - "weight" to the sum if the node has pods which - matches the corresponding podAffinityTerm; - the node(s) with the highest sum are the most - preferred. - items: - description: The weights of all of the matched - WeightedPodAffinityTerm fields are added - per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity - term, associated with the corresponding - weight. - properties: - labelSelector: - description: A label query over a - set of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in - the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements - specified by this field are not met at scheduling - time, the pod will not be scheduled onto the - node. If the anti-affinity requirements specified - by this field cease to be met at some point - during pod execution (e.g. due to a pod label - update), the system may or may not try to - eventually evict the pod from its node. When - there are multiple elements, the lists of - nodes corresponding to each podAffinityTerm - are intersected, i.e. all terms must be satisfied. - items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this pod - should be co-located (affinity) or not co-located - (anti-affinity) with, where co-located is - defined as running on a node whose value - of the label with key matches - that of any node on which a pod of the set - of pods is running - properties: - labelSelector: - description: A label query over a set - of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a - list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a - set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values - array must be non-empty. If - the operator is Exists or - DoesNotExist, the values array - must be empty. This array - is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies - to. The term is applied to the union - of the namespaces selected by this field - and the ones listed in the namespaces - field. null selector and null or empty - namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a - list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a - set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values - array must be non-empty. If - the operator is Exists or - DoesNotExist, the values array - must be empty. This array - is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates - whether pods running as this service account should - have an API token automatically mounted. - type: boolean - dnsConfig: - description: Specifies the DNS parameters of a pod. - Parameters specified here will be merged to the generated - DNS configuration based on DNSPolicy. - properties: - nameservers: - description: A list of DNS name server IP addresses. - This will be appended to the base nameservers - generated from DNSPolicy. Duplicated nameservers - will be removed. - items: - type: string - type: array - options: - description: A list of DNS resolver options. This - will be merged with the base options generated - from DNSPolicy. Duplicated entries will be removed. - Resolution options given in Options will override - those that appear in the base DNSPolicy. - items: - description: PodDNSConfigOption defines DNS resolver - options of a pod. - properties: - name: - description: Required. - type: string - value: - type: string - type: object - type: array - searches: - description: A list of DNS search domains for host-name - lookup. This will be appended to the base search - paths generated from DNSPolicy. Duplicated search - paths will be removed. - items: - type: string - type: array - type: object - dnsPolicy: - description: Set DNS policy for the pod. Defaults to - "ClusterFirst". Valid values are 'ClusterFirst', 'Default' - or 'None'. DNS parameters given in DNSConfig will - be merged with the policy selected with DNSPolicy. - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information - about services should be injected into pod''s environment - variables, matching the syntax of Docker links. Optional: - Defaults to true.' - type: boolean - env: - description: List of environment variables that can - be provided to the containers belonging to the pod. - items: - description: EnvVar represents an environment variable - present in a Container. - properties: - name: - description: Name of the environment variable. - Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously defined environment - variables in the container and any service environment - variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless - of whether the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: - supports metadata.name, metadata.namespace, - `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema the - FieldPath is written in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path of the field to select - in the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format - of the exposed resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in - the pod's namespace - properties: - key: - description: The key of the secret to - select from. Must be a valid secret - key. - type: string - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret - or its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - hostAliases: - description: HostAliases is an optional list of hosts - and IPs that will be injected into the pod's hosts - file if specified. This is only valid for non-hostNetwork - pods. - items: - description: HostAlias holds the mapping between IP - and hostnames that will be injected as an entry - in the pod's hosts file. - properties: - hostnames: - description: Hostnames for the above IP address. - items: - type: string - type: array - ip: - description: IP address of the host file entry. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - hostNetwork: - description: HostNetwork specifies whether the pod may - use the node network namespace - type: boolean - imagePullSecrets: - description: ImagePullSecrets gives the name of the - secret used by the pod to pull the image if specified - items: - description: LocalObjectReference contains enough - information to let you locate the referenced object - inside the same namespace. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - type: array - x-kubernetes-list-type: atomic - nodeSelector: - additionalProperties: - type: string - description: 'NodeSelector is a selector which must - be true for the pod to fit on a node. Selector which - must match a node''s labels for the pod to be scheduled - on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - priorityClassName: - description: If specified, indicates the pod's priority. - "system-node-critical" and "system-cluster-critical" - are two special keywords which indicate the highest - priorities with the former being the highest priority. - Any other name must be defined by creating a PriorityClass - object with that name. If not specified, the pod priority - will be default or zero if there is no default. - type: string - runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass - object in the node.k8s.io group, which should be used - to run this pod. If no RuntimeClass resource matches - the named class, the pod will not be run. If unset - or empty, the "legacy" RuntimeClass will be used, - which is an implicit class with an empty definition - that uses the default runtime handler. More info: - https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md - This is a beta feature as of Kubernetes v1.14.' - type: string - schedulerName: - description: SchedulerName specifies the scheduler to - be used to dispatch the Pod - type: string - securityContext: - description: 'SecurityContext holds pod-level security - attributes and common container settings. Optional: - Defaults to empty. See type description for default - values of each field.' - properties: - fsGroup: - description: "A special supplemental group that - applies to all containers in a pod. Some volume - types allow the Kubelet to change the ownership - of that volume to be owned by the pod: \n 1. The - owning GID will be the FSGroup 2. The setgid bit - is set (new files created in the volume will be - owned by FSGroup) 3. The permission bits are OR'd - with rw-rw---- \n If unset, the Kubelet will not - modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name - is windows." - format: int64 - type: integer - fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior - of changing ownership and permission of the volume - before being exposed inside Pod. This field will - only apply to volume types which support fsGroup - based ownership(and permissions). It will have - no effect on ephemeral volume types such as: secret, - configmaps and emptydir. Valid values are "OnRootMismatch" - and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name - is windows.' - type: string - runAsGroup: - description: The GID to run the entrypoint of the - container process. Uses runtime default if unset. - May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the - value specified in SecurityContext takes precedence - for that container. Note that this field cannot - be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run - as a non-root user. If true, the Kubelet will - validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start - the container if it does. If unset or false, no - such validation will be performed. May also be - set in SecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in - SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the - container process. Defaults to user specified - in image metadata if unspecified. May also be - set in SecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in - SecurityContext takes precedence for that container. - Note that this field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to - all containers. If unspecified, the container - runtime will allocate a random SELinux context - for each container. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence - for that container. Note that this field cannot - be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that - applies to the container. - type: string - role: - description: Role is a SELinux role label that - applies to the container. - type: string - type: - description: Type is a SELinux type label that - applies to the container. - type: string - user: - description: User is a SELinux user label that - applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by the containers - in this pod. Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. - The profile must be preconfigured on the node - to work. Must be a descending path, relative - to the kubelet's configured seccomp profile - location. Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: - \n Localhost - a profile defined in a file - on the node should be used. RuntimeDefault - - the container runtime default profile should - be used. Unconfined - no profile should be - applied." - type: string - required: - - type - type: object - supplementalGroups: - description: A list of groups applied to the first - process run in each container, in addition to - the container's primary GID. If unspecified, - no groups will be added to any container. Note - that this field cannot be set when spec.os.name - is windows. - items: - format: int64 - type: integer - type: array - sysctls: - description: Sysctls hold a list of namespaced sysctls - used for the pod. Pods with unsupported sysctls - (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name - is windows. - items: - description: Sysctl defines a kernel parameter - to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - windowsOptions: - description: The Windows specific settings applied - to all containers. If unspecified, the options - within a container's SecurityContext will be used. - If set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name - is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the - GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name - of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. - This field is alpha-level and will only be - honored by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the - feature flag will result in errors when validating - the Pod. All of a Pod's containers must have - the same effective HostProcess value (it is - not allowed to have a mix of HostProcess containers - and non-HostProcess containers). In addition, - if HostProcess is true then HostNetwork must - also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run - the entrypoint of the container process. Defaults - to the user specified in image metadata if - unspecified. May also be set in PodSecurityContext. - If set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence. - type: string - type: object - type: object - tolerations: - description: If specified, the pod's tolerations. - items: - description: The pod this Toleration is attached to - tolerates any taint that matches the triple - using the matching operator . - properties: - effect: - description: Effect indicates the taint effect - to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, - PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration - applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; - this combination means to match all values and - all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists and - Equal. Defaults to Equal. Exists is equivalent - to wildcard for value, so that a pod can tolerate - all taints of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the - period of time the toleration (which must be - of effect NoExecute, otherwise this field is - ignored) tolerates the taint. By default, it - is not set, which means tolerate the taint forever - (do not evict). Zero and negative values will - be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration - matches to. If the operator is Exists, the value - should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - topologySpreadConstraints: - description: TopologySpreadConstraints controls how - Pods are spread across your cluster among failure-domains - such as regions, zones, nodes, and other user-defined - topology domains. - items: - description: TopologySpreadConstraint specifies how - to spread matching pods among the given topology. - properties: - labelSelector: - description: LabelSelector is used to find matching - pods. Pods that match this label selector are - counted to determine the number of pods in their - corresponding topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of - label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, a - key, and an operator that relates the - key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only - "value". The requirements are ANDed. - type: object - type: object - matchLabelKeys: - description: MatchLabelKeys is a set of pod label - keys to select the pods over which spreading - will be calculated. The keys are used to lookup - values from the incoming pod labels, those key-value - labels are ANDed with labelSelector to select - the group of existing pods over which spreading - will be calculated for the incoming pod. Keys - that don't exist in the incoming pod labels - will be ignored. A null or empty list means - only match against labelSelector. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: 'MaxSkew describes the degree to - which pods may be unevenly distributed. When - `whenUnsatisfiable=DoNotSchedule`, it is the - maximum permitted difference between the number - of matching pods in the target topology and - the global minimum. The global minimum is the - minimum number of matching pods in an eligible - domain or zero if the number of eligible domains - is less than MinDomains. For example, in a 3-zone - cluster, MaxSkew is set to 1, and pods with - the same labelSelector spread as 2/2/1: In this - case, the global minimum is 1. | zone1 | zone2 - | zone3 | | P P | P P | P | - if MaxSkew - is 1, incoming pod can only be scheduled to - zone3 to become 2/2/2; scheduling it onto zone1(zone2) - would make the ActualSkew(3-1) on zone1(zone2) - violate MaxSkew(1). - if MaxSkew is 2, incoming - pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to topologies - that satisfy it. It''s a required field. Default - value is 1 and 0 is not allowed.' - format: int32 - type: integer - minDomains: - description: "MinDomains indicates a minimum number - of eligible domains. When the number of eligible - domains with matching topology keys is less - than minDomains, Pod Topology Spread treats - \"global minimum\" as 0, and then the calculation - of Skew is performed. And when the number of - eligible domains with matching topology keys - equals or greater than minDomains, this value - has no effect on scheduling. As a result, when - the number of eligible domains is less than - minDomains, scheduler won't schedule more than - maxSkew Pods to those domains. If value is nil, - the constraint behaves as if MinDomains is equal - to 1. Valid values are integers greater than - 0. When value is not nil, WhenUnsatisfiable - must be DoNotSchedule. \n For example, in a - 3-zone cluster, MaxSkew is set to 2, MinDomains - is set to 5 and pods with the same labelSelector - spread as 2/2/2: | zone1 | zone2 | zone3 | | - \ P P | P P | P P | The number of domains - is less than 5(MinDomains), so \"global minimum\" - is treated as 0. In this situation, new pod - with the same labelSelector cannot be scheduled, - because computed skew will be 3(3 - 0) if new - Pod is scheduled to any of the three zones, - it will violate MaxSkew. \n This is a beta field - and requires the MinDomainsInPodTopologySpread - feature gate to be enabled (enabled by default)." - format: int32 - type: integer - nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates how - we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. Options - are: - Honor: only nodes matching nodeAffinity/nodeSelector - are included in the calculations. - Ignore: - nodeAffinity/nodeSelector are ignored. All nodes - are included in the calculations. \n If this - value is nil, the behavior is equivalent to - the Honor policy. This is a alpha-level feature - enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how we - will treat node taints when calculating pod - topology spread skew. Options are: - Honor: - nodes without taints, along with tainted nodes - for which the incoming pod has a toleration, - are included. - Ignore: node taints are ignored. - All nodes are included. \n If this value is - nil, the behavior is equivalent to the Ignore - policy. This is a alpha-level feature enabled - by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - topologyKey: - description: TopologyKey is the key of node labels. - Nodes that have a label with this key and identical - values are considered to be in the same topology. - We consider each as a "bucket", - and try to put balanced number of pods into - each bucket. We define a domain as a particular - instance of a topology. Also, we define an eligible - domain as a domain whose nodes meet the requirements - of nodeAffinityPolicy and nodeTaintsPolicy. - e.g. If TopologyKey is "kubernetes.io/hostname", - each Node is a domain of that topology. And, - if TopologyKey is "topology.kubernetes.io/zone", - each zone is a domain of that topology. It's - a required field. - type: string - whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates how - to deal with a pod if it doesn''t satisfy the - spread constraint. - DoNotSchedule (default) - tells the scheduler not to schedule it. - ScheduleAnyway - tells the scheduler to schedule the pod in any - location, but giving higher precedence to - topologies that would help reduce the skew. - A constraint is considered "Unsatisfiable" for - an incoming pod if and only if every possible - node assignment for that pod would violate "MaxSkew" - on some topology. For example, in a 3-zone cluster, - MaxSkew is set to 1, and pods with the same - labelSelector spread as 3/1/1: | zone1 | zone2 - | zone3 | | P P P | P | P | If WhenUnsatisfiable - is set to DoNotSchedule, incoming pod can only - be scheduled to zone2(zone3) to become 3/2/1(3/1/2) - as ActualSkew(2-1) on zone2(zone3) satisfies - MaxSkew(1). In other words, the cluster can - still be imbalanced, but scheduler won''t make - it *more* imbalanced. It''s a required field.' - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: 'List of volumes that can be mounted by - containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' - items: - description: Volume represents a named volume in a - pod that may be accessed by any container in the - pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached to a kubelet''s - host machine and then exposed to the pod. More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in - the volume that you want to mount. If omitted, - the default is to mount by volume name. - Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can - leave the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will force - the readOnly setting in VolumeMounts. More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of the - persistent disk resource in AWS (Amazon - EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure Data - Disk mount on the host and bind mount to the - pod. - properties: - cachingMode: - description: 'cachingMode is the Host Caching - mode: None, Read Only, Read Write.' - type: string - diskName: - description: diskName is the Name of the data - disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of data disk - in the blob storage - type: string - fsType: - description: fsType is Filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are Shared: - multiple blob disks per storage account Dedicated: - single blob disk per storage account Managed: - azure managed data disk (only in managed - availability set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure File - Service mount on the host and bind mount to - the pod. - properties: - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of secret - that contains Azure Storage Account Name - and Key - type: string - shareName: - description: shareName is the azure share - Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount - on the host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as the - mounted root, rather than the full Ceph - tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: SecretFile - is the path to key ring for User, default - is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is the - rados user name, default is admin More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: - https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters - used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify the - volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. - Directories within the path are not affected - by this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - ConfigMap will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. Paths - must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is handled - by certain external CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the CSI - driver that handles this volume. Consult - with your admin for the correct name as - registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", - "xfs", "ntfs". If not provided, the empty - value is passed to the associated CSI driver - which will determine the default filesystem - to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference - to the secret object containing sensitive - information to pass to the CSI driver to - complete the CSI NodePublishVolume and NodeUnpublishVolume - calls. This field is optional, and may - be empty if no secret is required. If the - secret object contains more than one secret, - all secret references are passed. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults to - false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. - Consult your driver's documentation for - supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward API - about the pod that should populate this volume - properties: - defaultMode: - description: 'Optional: mode bits to use on - created files by default. Must be a Optional: - mode bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. - Directories within the path are not affected - by this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward API - volume file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used - to set permissions on this file, must - be an octal value between 0000 and - 0777 or a decimal value between 0 - and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type - of storage medium should back this directory. - The default is "" which means to use the - node''s default medium. Must be an empty - string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage on - memory medium EmptyDir would be the minimum - value between the SizeLimit specified here - and the sum of memory limits of all containers - in a pod. The default is nil which means - that the limit is undefined. More info: - http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume that - is handled by a cluster storage driver. The - volume's lifecycle is tied to the pod that defines - it - it will be created before the pod starts, - and deleted when the pod is removed. \n Use - this if: a) the volume is only needed while - the pod runs, b) features of normal volumes - like restoring from snapshot or capacity tracking - are needed, c) the storage driver is specified - through a storage class, and d) the storage - driver supports dynamic volume provisioning - through a PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection between - this volume type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one of the vendor-specific - APIs for volumes that persist for longer than - the lifecycle of an individual pod. \n Use CSI - for light-weight local ephemeral volumes if - the CSI driver is meant to be used that way - - see the documentation of the driver for more - information. \n A pod can use both types of - ephemeral volumes and persistent volumes at - the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a stand-alone - PVC to provision the volume. The pod in - which this EphemeralVolumeSource is embedded - will be the owner of the PVC, i.e. the PVC - will be deleted together with the pod. The - name of the PVC will be `-` where `` is the name - from the `PodSpec.Volumes` array entry. - Pod validation will reject the pod if the - concatenated name is not valid for a PVC - (for example, too long). \n An existing - PVC with that name that is not owned by - the pod will *not* be used for the pod to - avoid using an unrelated volume by mistake. - Starting the pod is then blocked until the - unrelated PVC is removed. If such a pre-created - PVC is meant to be used by the pod, the - PVC has to updated with an owner reference - to the pod once the pod exists. Normally - this should not be necessary, but it may - be useful when manually reconstructing a - broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. \n - Required, must not be nil." - properties: - metadata: - description: May contain labels and annotations - that will be copied into the PVC when - creating it. No other fields are allowed - and will be rejected during validation. - type: object - spec: - description: The specification for the - PersistentVolumeClaim. The entire content - is copied unchanged into the PVC that - gets created from this template. The - same fields as in a PersistentVolumeClaim - are also valid here. - properties: - accessModes: - description: 'accessModes contains - the desired access modes the volume - should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can - be used to specify either: * An - existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create a new - volume based on the contents of - the specified data source. If the - AnyVolumeDataSource feature gate - is enabled, this field will always - have the same contents as the DataSourceRef - field.' - properties: - apiGroup: - description: APIGroup is the group - for the resource being referenced. - If APIGroup is not specified, - the specified Kind must be in - the core API group. For any - other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may be any - local object from a non-empty API - group (non core object) or a PersistentVolumeClaim - object. When this field is specified, - volume binding will only succeed - if the type of the specified object - matches some installed volume populator - or dynamic provisioner. This field - will replace the functionality of - the DataSource field and as such - if both fields are non-empty, they - must have the same value. For backwards - compatibility, both fields (DataSource - and DataSourceRef) will be set to - the same value automatically if - one of them is empty and the other - is non-empty. There are two important - differences between DataSource and - DataSourceRef: * While DataSource - only allows two specific types of - objects, DataSourceRef allows - any non-core object, as well as - PersistentVolumeClaim objects. * - While DataSource ignores disallowed - values (dropping them), DataSourceRef preserves - all values, and generates an error - if a disallowed value is specified. - (Beta) Using this field requires - the AnyVolumeDataSource feature - gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the group - for the resource being referenced. - If APIGroup is not specified, - the specified Kind must be in - the core API group. For any - other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the volume - should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed - to specify resource requirements - that are lower than previous value - but must still be higher than capacity - recorded in the status field of - the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of compute - resources allowed. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, - it defaults to Limits if that - is explicitly specified, otherwise - to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query - over volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is - the name of the StorageClass required - by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what - type of volume is required by the - claim. Value of Filesystem is implied - when not included in claim spec. - type: string - volumeName: - description: volumeName is the binding - reference to the PersistentVolume - backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel resource - that is attached to a kubelet's host machine - and then exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be - "ext4" if unspecified. TODO: how do we prevent - errors in the filesystem from compromising - the machine' - type: string - lun: - description: 'lun is Optional: FC target lun - number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: FC target - worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume world - wide identifiers (wwids) Either wwids or - combination of targetWWNs and lun must be - set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic volume - resource that is provisioned/attached using - an exec based plugin. - properties: - driver: - description: driver is the name of the driver - to use for this volume. - type: string - fsType: - description: fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". The default filesystem depends - on FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this field - holds extra command options if any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the plugin - scripts. This may be empty if no secret - object is specified. If the secret object - contains more than one secret, all secrets - are passed to the plugin scripts.' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker volume - attached to a kubelet's host machine. This depends - on the Flocker control service being running - properties: - datasetName: - description: datasetName is Name of the dataset - stored as metadata -> name on the dataset - for Flocker should be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of the - dataset. This is unique identifier of a - Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents a GCE - Disk resource that is attached to a kubelet''s - host machine and then exposed to the pod. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type of - the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in - the volume that you want to mount. If omitted, - the default is to mount by volume name. - Examples: For volume /dev/sda1, you specify - the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can - leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of the - PD resource in GCE. Used to identify the - disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force the - ReadOnly setting in VolumeMounts. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container with - a git repo, mount an EmptyDir into an InitContainer - that clones the repo using git, then mount the - EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target directory - name. Must not contain or start with '..'. If - '.' is supplied, the volume directory will - be the git repository. Otherwise, if specified, - the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash for - the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint name - that details Glusterfs topology. More info: - https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume - path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force the - Glusterfs volume to be mounted with read-only - permissions. Defaults to false. More info: - https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that is - directly exposed to the container. This is generally - used for system agents or other privileged things - that are allowed to see the host machine. Most - containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can - use host directory mounts and who can/can not - mount host directories as read/write.' - properties: - path: - description: 'path of the directory on the - host. If the path is a symlink, it will - follow the link to the real path. More info: - https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume Defaults - to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk resource - that is attached to a kubelet''s host machine - and then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines whether - support iSCSI Discovery CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether - support iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom iSCSI - Initiator Name. If initiatorName is specified - with iscsiInterface simultaneously, new - iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified - Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun - number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target Portal - List. The portal is either an IP or ip_addr:port - if the port is other than default (typically - TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force the - ReadOnly setting in VolumeMounts. Defaults - to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret - for iSCSI target and initiator authentication - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target - Portal. The Portal is either an IP or ip_addr:port - if the port is other than default (typically - TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be a DNS_LABEL - and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount on the - host that shares a pod''s lifetime More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by the - NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force the - NFS export to be mounted with read-only - permissions. Defaults to false. More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or IP - address of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this - volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents a - PhotonController persistent disk attached and - mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx - volume attached and mounted on kubelets host - machine - properties: - fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs". Implicitly inferred to - be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one resources - secrets, configmaps, and downward API - properties: - defaultMode: - description: defaultMode are the mode bits - used to set permissions on created files - by default. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for - mode bits. Directories within the path are - not affected by this setting. This might - be in conflict with other options that affect - the file mode, like fsGroup, and the result - can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume - projections - items: - description: Projection that may be projected - along with other supported volume types - properties: - configMap: - description: configMap information about - the configMap data to project - properties: - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced ConfigMap - will be projected into the volume - as a file whose name is the key - and content is the value. If specified, - the listed keys will be projected - into the specified paths, and - unlisted keys will not be present. - If a key is specified which is - not present in the ConfigMap, - the volume setup will error unless - it is marked optional. Paths must - be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key - to a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an - octal value between 0000 - and 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and decimal - values, JSON requires decimal - values for mode bits. If - not specified, the volume - defaultMode will be used. - This might be in conflict - with other options that - affect the file mode, like - fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map - the key to. May not be an - absolute path. May not contain - the path element '..'. May - not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must - be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data to project - properties: - items: - description: Items is a list of - DownwardAPIVolume file - items: - description: DownwardAPIVolumeFile - represents information to create - the file containing the pod - field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only - annotations, labels, name - and namespace are supported.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode - bits used to set permissions - on this file, must be an - octal value between 0000 - and 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and decimal - values, JSON requires decimal - values for mode bits. If - not specified, the volume - defaultMode will be used. - This might be in conflict - with other options that - affect the file mode, like - fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path - is the relative path name - of the file to be created. - Must not be absolute or - contain the ''..'' path. - Must be utf-8 encoded. The - first item of the relative - path must not start with - ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) are - currently supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format of - the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about - the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced Secret - will be projected into the volume - as a file whose name is the key - and content is the value. If specified, - the listed keys will be projected - into the specified paths, and - unlisted keys will not be present. - If a key is specified which is - not present in the Secret, the - volume setup will error unless - it is marked optional. Paths must - be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key - to a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an - octal value between 0000 - and 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and decimal - values, JSON requires decimal - values for mode bits. If - not specified, the volume - defaultMode will be used. - This might be in conflict - with other options that - affect the file mode, like - fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map - the key to. May not be an - absolute path. May not contain - the path element '..'. May - not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional field specify - whether the Secret or its key - must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is - information about the serviceAccountToken - data to project - properties: - audience: - description: audience is the intended - audience of the token. A recipient - of a token must identify itself - with an identifier specified in - the audience of the token, and - otherwise should reject the token. - The audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is - the requested duration of validity - of the service account token. - As the token approaches expiration, - the kubelet volume plugin will - proactively rotate the service - account token. The kubelet will - start trying to rotate the token - if the token is older than 80 - percent of its time to live or - if the token is older than 24 - hours.Defaults to 1 hour and must - be at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative - to the mount point of the file - to project the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte mount - on the host that shares a pod's lifetime - properties: - group: - description: group to map volume access to - Default is no group - type: string - readOnly: - description: readOnly here will force the - Quobyte volume to be mounted with read-only - permissions. Defaults to false. - type: boolean - registry: - description: registry represents a single - or multiple Quobyte Registry services specified - as a string as host:port pair (multiple - entries are separated with commas) which - acts as the central registry for volumes - type: string - tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is set - by the plugin - type: string - user: - description: user to map volume access to - Defaults to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block Device - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - image: - description: 'image is the rados image name. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key ring - for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection of - Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. - Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force the - ReadOnly setting in VolumeMounts. Defaults - to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the authentication - secret for RBDUser. If provided overrides - keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. - Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO persistent - volume attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: gateway is the host address of - the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name - of the ScaleIO Protection Domain for the - configured storage. - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the secret - for ScaleIO user and other sensitive information. - If this is not provided, Login operation - will fail. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, default - false - type: boolean - storageMode: - description: storageMode indicates whether - the storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO Storage - Pool associated with the protection domain. - type: string - system: - description: system is the name of the storage - system as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of a volume - already created in the ScaleIO system that - is associated with this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that - should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. - Directories within the path are not affected - by this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value - pair in the Data field of the referenced - Secret will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the Secret, the volume setup will error - unless it is marked optional. Paths must - be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether - the Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the - secret in the pod''s namespace to use. More - info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API credentials. If - not specified, default values will be attempted. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume names - are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies the - scope of the volume within StorageOS. If - no namespace is specified then the Pod's - namespace will be used. This allows the - Kubernetes name scoping to be mirrored within - StorageOS for tighter integration. Set VolumeName - to any name to override the default behaviour. - Set to "default" if you are not using namespaces - within StorageOS. Namespaces that do not - pre-exist within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere - volume attached and mounted on kubelets host - machine - properties: - fsType: - description: fsType is filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage - Policy Based Management (SPBM) profile ID - associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the storage - Policy Based Management (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path that identifies - vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - taskServiceAccountName: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - timeout: - description: 'Timeout Deprecated: use pipelineRunSpec.Timeouts.Pipeline - instead Time after which the Pipeline times out. Defaults to - never. Refer to Go''s ParseDuration documentation for expected - format: https://golang.org/pkg/time/#ParseDuration' - type: string - timeouts: - description: Time after which the Pipeline times out. Currently - three keys are accepted in the map pipeline, tasks and finally - with Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally - properties: - finally: - description: Finally sets the maximum allowed duration of - this pipeline's finally - type: string - pipeline: - description: Pipeline sets the maximum allowed duration for - execution of the entire pipeline. The sum of individual - timeouts for tasks and finally must not exceed this value. - type: string - tasks: - description: Tasks sets the maximum allowed duration of this - pipeline's tasks - type: string - type: object - workspaces: - description: Workspaces holds a set of workspace bindings that - must match names with those declared in the pipeline. - items: - description: WorkspaceBinding maps a Task's declared workspace - to a Volume. - properties: - configMap: - description: ConfigMap represents a configMap that should - populate this workspace. - properties: - defaultMode: - description: 'defaultMode is optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value pair - in the Data field of the referenced ConfigMap will - be projected into the volume as a file whose name - is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. If a - key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - csi: - description: CSI (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers. - properties: - driver: - description: driver is the name of the CSI driver that - handles this volume. Consult with your admin for the - correct name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the - associated CSI driver which will determine the default - filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference to - the secret object containing sensitive information - to pass to the CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This field is optional, - and may be empty if no secret is required. If the - secret object contains more than one secret, all secret - references are passed. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. Consult - your driver's documentation for supported values. - type: object - required: - - driver - type: object - emptyDir: - description: 'EmptyDir represents a temporary directory - that shares a Task''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - Either this OR PersistentVolumeClaim can be used.' - properties: - medium: - description: 'medium represents what type of storage - medium should back this directory. The default is - "" which means to use the node''s default medium. - Must be an empty string (default) or Memory. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount of local - storage required for this EmptyDir volume. The size - limit is also applicable for memory medium. The maximum - usage on memory medium EmptyDir would be the minimum - value between the SizeLimit specified here and the - sum of memory limits of all containers in a pod. The - default is nil which means that the limit is undefined. - More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - name: - description: Name is the name of the workspace populated - by the volume. - type: string - persistentVolumeClaim: - description: PersistentVolumeClaimVolumeSource represents - a reference to a PersistentVolumeClaim in the same namespace. - Either this OR EmptyDir can be used. - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly setting - in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - projected: - description: Projected represents a projected volume that - should populate this workspace. - properties: - defaultMode: - description: defaultMode are the mode bits used to set - permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this - setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected along - with other supported volume types - properties: - configMap: - description: configMap information about the configMap - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - ConfigMap will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. Paths - must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information about the - downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used - to set permissions on this file, must - be an octal value between 0000 and - 0777 or a decimal value between 0 - and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about the secret - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - Secret will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the Secret, the volume setup will error - unless it is marked optional. Paths must - be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: audience is the intended audience - of the token. A recipient of a token must - identify itself with an identifier specified - in the audience of the token, and otherwise - should reject the token. The audience defaults - to the identifier of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is the requested - duration of validity of the service account - token. As the token approaches expiration, - the kubelet volume plugin will proactively - rotate the service account token. The kubelet - will start trying to rotate the token if - the token is older than 80 percent of its - time to live or if the token is older than - 24 hours.Defaults to 1 hour and must be - at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative to - the mount point of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - secret: - description: Secret represents a secret that should populate - this workspace. - properties: - defaultMode: - description: 'defaultMode is Optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value pair - in the Data field of the referenced Secret will be - projected into the volume as a file whose name is - the key and content is the value. If specified, the - listed keys will be projected into the specified paths, - and unlisted keys will not be present. If a key is - specified which is not present in the Secret, the - volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether the Secret - or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the secret in - the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - subPath: - description: SubPath is optionally a directory on the volume - which should be used for this binding (i.e. the volume - will be mounted at this sub directory). - type: string - volumeClaimTemplate: - description: VolumeClaimTemplate is a template for a claim - that will be created in the same namespace. The PipelineRun - controller is responsible for creating a unique claim - for each instance of PipelineRun. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema - of this representation of an object. Servers should - convert recognized schemas to the latest internal - value, and may reject unrecognized values. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the - REST resource this object represents. Servers may - infer this from the endpoint the client submits requests - to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - description: 'Standard object''s metadata. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata' - type: object - spec: - description: 'spec defines the desired characteristics - of a volume requested by a pod author. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - accessModes: - description: 'accessModes contains the desired access - modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be used to specify - either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) If the - provisioner or an external controller can support - the specified data source, it will create a new - volume based on the contents of the specified - data source. If the AnyVolumeDataSource feature - gate is enabled, this field will always have the - same contents as the DataSourceRef field.' - properties: - apiGroup: - description: APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type of resource being - referenced - type: string - name: - description: Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies the object - from which to populate the volume with data, if - a non-empty volume is desired. This may be any - local object from a non-empty API group (non core - object) or a PersistentVolumeClaim object. When - this field is specified, volume binding will only - succeed if the type of the specified object matches - some installed volume populator or dynamic provisioner. - This field will replace the functionality of the - DataSource field and as such if both fields are - non-empty, they must have the same value. For - backwards compatibility, both fields (DataSource - and DataSourceRef) will be set to the same value - automatically if one of them is empty and the - other is non-empty. There are two important differences - between DataSource and DataSourceRef: * While - DataSource only allows two specific types of objects, - DataSourceRef allows any non-core object, as - well as PersistentVolumeClaim objects. * While - DataSource ignores disallowed values (dropping - them), DataSourceRef preserves all values, and - generates an error if a disallowed value is specified. - (Beta) Using this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the group for the resource - being referenced. If APIGroup is not specified, - the specified Kind must be in the core API - group. For any other third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type of resource being - referenced - type: string - name: - description: Name is the name of resource being - referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the minimum resources - the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than previous - value but must still be higher than capacity recorded - in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. If Requests - is omitted for a container, it defaults to - Limits if that is explicitly specified, otherwise - to an implementation-defined value. More info: - https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query over volumes - to consider for binding. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is the name of the - StorageClass required by the claim. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what type of volume - is required by the claim. Value of Filesystem - is implied when not included in claim spec. - type: string - volumeName: - description: volumeName is the binding reference - to the PersistentVolume backing this claim. - type: string - type: object - status: - description: 'status represents the current information/status - of a persistent volume claim. Read-only. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - accessModes: - description: 'accessModes contains the actual access - modes the volume backing the PVC has. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: allocatedResources is the storage resource - within AllocatedResources tracks the capacity - allocated to a PVC. It may be larger than the - actual capacity when a volume expansion operation - is requested. For storage quota, the larger value - from allocatedResources and PVC.spec.resources - is used. If allocatedResources is not set, PVC.spec.resources - alone is used for quota calculation. If a volume - expansion capacity request is lowered, allocatedResources - is only lowered if there are no expansion operations - in progress and if the actual volume capacity - is equal or lower than the requested capacity. - This is an alpha field and requires enabling RecoverVolumeExpansionFailure - feature. - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: capacity represents the actual resources - of the underlying volume. - type: object - conditions: - description: conditions is the current Condition - of persistent volume claim. If underlying persistent - volume is being resized then the Condition will - be set to 'ResizeStarted'. - items: - description: PersistentVolumeClaimCondition contails - details about state of pvc - properties: - lastProbeTime: - description: lastProbeTime is the time we - probed the condition. - format: date-time - type: string - lastTransitionTime: - description: lastTransitionTime is the time - the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: message is the human-readable - message indicating details about last transition. - type: string - reason: - description: reason is a unique, this should - be a short, machine understandable string - that gives the reason for condition's last - transition. If it reports "ResizeStarted" - that means the underlying persistent volume - is being resized. - type: string - status: - type: string - type: - description: PersistentVolumeClaimConditionType - is a valid value of PersistentVolumeClaimCondition.Type - type: string - required: - - status - - type - type: object - type: array - phase: - description: phase represents the current phase - of PersistentVolumeClaim. - type: string - resizeStatus: - description: resizeStatus stores status of resize - operation. ResizeStatus is not set by default - but when expansion is complete resizeStatus is - set to empty string by resize controller or kubelet. - This is an alpha field and requires enabling RecoverVolumeExpansionFailure - feature. - type: string - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - pod_spec: - description: PodSpec provides the basis for running the test under - a Kubernetes agent - properties: - activeDeadlineSeconds: - description: Optional duration in seconds the pod may be active - on the node relative to StartTime before the system will actively - try to mark it failed and kill associated containers. Value - must be a positive integer. - format: int64 - type: integer - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for - the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods - to nodes that satisfy the affinity expressions specified - by this field, but it may choose a node that violates - one or more of the expressions. The node that is most - preferred is the one with the greatest sum of weights, - i.e. for each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum by iterating - through the elements of this field and adding "weight" - to the sum if the node matches the corresponding matchExpressions; - the node(s) with the highest sum are the most preferred. - items: - description: An empty preferred scheduling term matches - all objects with implicit weight 0 (i.e. it's a no-op). - A null preferred scheduling term matches no objects - (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with - the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: A node selector requirement is - a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, the - values array must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. If the - operator is Gt or Lt, the values array - must have a single element, which will - be interpreted as an integer. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: A node selector requirement is - a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, the - values array must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. If the - operator is Gt or Lt, the values array - must have a single element, which will - be interpreted as an integer. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - weight: - description: Weight associated with matching the - corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by - this field are not met at scheduling time, the pod will - not be scheduled onto the node. If the affinity requirements - specified by this field cease to be met at some point - during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from - its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. - The terms are ORed. - items: - description: A null or empty node selector term - matches no objects. The requirements of them are - ANDed. The TopologySelectorTerm type implements - a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements - by node's labels. - items: - description: A node selector requirement is - a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, the - values array must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. If the - operator is Gt or Lt, the values array - must have a single element, which will - be interpreted as an integer. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector requirements - by node's fields. - items: - description: A node selector requirement is - a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: The label key that the selector - applies to. - type: string - operator: - description: Represents a key's relationship - to a set of values. Valid operators - are In, NotIn, Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of string values. - If the operator is In or NotIn, the - values array must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be empty. If the - operator is Gt or Lt, the values array - must have a single element, which will - be interpreted as an integer. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - type: array - required: - - nodeSelectorTerms - type: object - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. - co-locate this pod in the same node, zone, etc. as some - other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods - to nodes that satisfy the affinity expressions specified - by this field, but it may choose a node that violates - one or more of the expressions. The node that is most - preferred is the one with the greatest sum of weights, - i.e. for each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum by iterating - through the elements of this field and adding "weight" - to the sum if the node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest sum are - the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by - this field and the ones listed in the namespaces - field. null selector and null or empty namespaces - list means "this pod's namespace". An empty - selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. - The term is applied to the union of the namespaces - listed in this field and the ones selected - by namespaceSelector. null or empty namespaces - list and null namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the - pods matching the labelSelector in the specified - namespaces, where co-located is defined as - running on a node whose value of the label - with key topologyKey matches that of any node - on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching the - corresponding podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified by - this field are not met at scheduling time, the pod will - not be scheduled onto the node. If the affinity requirements - specified by this field cease to be met at some point - during pod execution (e.g. due to a pod label update), - the system may or may not try to eventually evict the - pod from its node. When there are multiple elements, - the lists of nodes corresponding to each podAffinityTerm - are intersected, i.e. all terms must be satisfied. - items: - description: Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not - co-located (anti-affinity) with, where co-located - is defined as running on a node whose value of the - label with key matches that of any node - on which a pod of the set of pods is running - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules - (e.g. avoid putting this pod in the same node, zone, etc. - as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule pods - to nodes that satisfy the anti-affinity expressions - specified by this field, but it may choose a node that - violates one or more of the expressions. The node that - is most preferred is the one with the greatest sum of - weights, i.e. for each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - anti-affinity expressions, etc.), compute a sum by iterating - through the elements of this field and adding "weight" - to the sum if the node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest sum are - the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm - fields are added per-node to find the most preferred - node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated - with the corresponding weight. - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by - this field and the ones listed in the namespaces - field. null selector and null or empty namespaces - list means "this pod's namespace". An empty - selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. - The term is applied to the union of the namespaces - listed in this field and the ones selected - by namespaceSelector. null or empty namespaces - list and null namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the - pods matching the labelSelector in the specified - namespaces, where co-located is defined as - running on a node whose value of the label - with key topologyKey matches that of any node - on which any of the selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching the - corresponding podAffinityTerm, in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements specified - by this field are not met at scheduling time, the pod - will not be scheduled onto the node. If the anti-affinity - requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod - label update), the system may or may not try to eventually - evict the pod from its node. When there are multiple - elements, the lists of nodes corresponding to each podAffinityTerm - are intersected, i.e. all terms must be satisfied. - items: - description: Defines a set of pods (namely those matching - the labelSelector relative to the given namespace(s)) - that this pod should be co-located (affinity) or not - co-located (anti-affinity) with, where co-located - is defined as running on a node whose value of the - label with key matches that of any node - on which a pod of the set of pods is running - properties: - labelSelector: - description: A label query over a set of resources, - in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set of namespaces - that the term applies to. The term is applied - to the union of the namespaces selected by this - field and the ones listed in the namespaces field. - null selector and null or empty namespaces list - means "this pod's namespace". An empty selector - ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static list - of namespace names that the term applies to. The - term is applied to the union of the namespaces - listed in this field and the ones selected by - namespaceSelector. null or empty namespaces list - and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located (affinity) - or not co-located (anti-affinity) with the pods - matching the labelSelector in the specified namespaces, - where co-located is defined as running on a node - whose value of the label with key topologyKey - matches that of any node on which any of the selected - pods is running. Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a - service account token should be automatically mounted. - type: boolean - containers: - description: List of containers belonging to the pod. Containers - cannot currently be added or removed. There must be at least - one container in a Pod. Cannot be updated. - items: - description: A single application container that you want to - run within a pod. - properties: - args: - description: 'Arguments to the entrypoint. The container - image''s CMD is used if this is not provided. Variable - references $(VAR_NAME) are expanded using the container''s - environment. If a variable cannot be resolved, the reference - in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) - syntax: i.e. "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never be expanded, - regardless of whether the variable exists or not. Cannot - be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - command: - description: 'Entrypoint array. Not executed within a shell. - The container image''s ENTRYPOINT is used if this is not - provided. Variable references $(VAR_NAME) are expanded - using the container''s environment. If a variable cannot - be resolved, the reference in the input string will be - unchanged. Double $$ are reduced to a single $, which - allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless of whether - the variable exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - env: - description: List of environment variables to set in the - container. Cannot be updated. - items: - description: EnvVar represents an environment variable - present in a Container. - properties: - name: - description: Name of the environment variable. Must - be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are - expanded using the previously defined environment - variables in the container and any service environment - variables. If a variable cannot be resolved, the - reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless of - whether the variable exists or not. Defaults to - "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports - metadata.name, metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, spec.nodeName, - spec.serviceAccountName, status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the - pod's namespace - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret or - its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - envFrom: - description: List of sources to populate environment variables - in the container. The keys defined within a source must - be a C_IDENTIFIER. All invalid keys will be reported as - an event when the container is starting. When a key exists - in multiple sources, the value associated with the last - source will take precedence. Values defined by an Env - with a duplicate key will take precedence. Cannot be updated. - items: - description: EnvFromSource represents the source of a - set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the ConfigMap must - be defined - type: boolean - type: object - prefix: - description: An optional identifier to prepend to - each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the Secret must be - defined - type: boolean - type: object - type: object - type: array - image: - description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management - to default or override container images in workload controllers - like Deployments and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management system should take - in response to container lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately after - a container is created. If the handler fails, the - container is terminated and restarted according to - its restart policy. Other management of the container - blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately before a - container is terminated due to an API request or management - event such as liveness/startup probe failure, preemption, - resource contention, etc. The handler is not called - if the container crashes or exits. The Pod''s termination - grace period countdown begins before the PreStop hook - is executed. Regardless of the outcome of the handler, - the container will eventually terminate within the - Pod''s termination grace period (unless delayed by - finalizers). Other management of the container blocks - until the hook completes or until the termination - grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of container liveness. Container - will be restarted if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: List of ports to expose from the container. - Not specifying a port here DOES NOT prevent that port - from being exposed. Any port which is listening on the - default "0.0.0.0" address inside a container will be accessible - from the network. Modifying this array with strategic - merge patch may corrupt the data. For more information - See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - items: - description: ContainerPort represents a network port in - a single container. - properties: - containerPort: - description: Number of port to expose on the pod's - IP address. This must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the external port - to. - type: string - hostPort: - description: Number of port to expose on the host. - If specified, this must be a valid port number, - 0 < x < 65536. If HostNetwork is specified, this - must match ContainerPort. Most containers do not - need this. - format: int32 - type: integer - name: - description: If specified, this must be an IANA_SVC_NAME - and unique within the pod. Each named port in a - pod must have a unique name. Name for the port that - can be referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must be UDP, TCP, - or SCTP. Defaults to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of container service readiness. - Container will be removed from service endpoints if the - probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by this container. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of - compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is omitted - for a container, it defaults to Limits if that is - explicitly specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the security options - the container should be run with. If set, the fields of - SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation controls whether - a process can gain more privileges than its parent - process. This bool directly controls if the no_new_privs - flag will be set on the container process. AllowPrivilegeEscalation - is true always when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this field cannot be - set when spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop when running - containers. Defaults to the default set of capabilities - granted by the container runtime. Note that this field - cannot be set when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - type: object - privileged: - description: Run container in privileged mode. Processes - in privileged containers are essentially equivalent - to root on the host. Defaults to false. Note that - this field cannot be set when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the type of proc mount - to use for the containers. The default is DefaultProcMount - which uses the container runtime defaults for readonly - paths and masked paths. This requires the ProcMountType - feature flag to be enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has a read-only - root filesystem. Default is false. Note that this - field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint of the container - process. Uses runtime default if unset. May also be - set in PodSecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run as - a non-root user. If true, the Kubelet will validate - the image at runtime to ensure that it does not run - as UID 0 (root) and fail to start the container if - it does. If unset or false, no such validation will - be performed. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the container - process. Defaults to user specified in image metadata - if unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to the - container. If unspecified, the container runtime will - allocate a random SELinux context for each container. May - also be set in PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name is - windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by this container. - If seccomp options are provided at both the pod & - container level, the container options override the - pod options. Note that this field cannot be set when - spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. - The profile must be preconfigured on the node - to work. Must be a descending path, relative to - the kubelet's configured seccomp profile location. - Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: \n - Localhost - a profile defined in a file on the - node should be used. RuntimeDefault - the container - runtime default profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings applied to - all containers. If unspecified, the options from the - PodSecurityContext will be used. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA - admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential spec - named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name - of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. This - field is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the feature - flag will result in errors when validating the - Pod. All of a Pod's containers must have the same - effective HostProcess value (it is not allowed - to have a mix of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess is true - then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the - entrypoint of the container process. Defaults - to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that the Pod has successfully - initialized. If specified, no other probes are executed - until this completes successfully. If this probe fails, - the Pod will be restarted, just as if the livenessProbe - failed. This can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, when it might - take a long time to load data or warm a cache, than during - steady-state operation. This cannot be updated. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this container should allocate a buffer - for stdin in the container runtime. If this is not set, - reads from stdin in the container will always result in - EOF. Default is false. - type: boolean - stdinOnce: - description: Whether the container runtime should close - the stdin channel after it has been opened by a single - attach. When stdin is true the stdin stream will remain - open across multiple attach sessions. If stdinOnce is - set to true, stdin is opened on container start, is empty - until the first client attaches to stdin, and then remains - open and accepts data until the client disconnects, at - which time stdin is closed and remains closed until the - container is restarted. If this flag is false, a container - processes that reads from stdin will never receive an - EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which the file to which - the container''s termination message will be written is - mounted into the container''s filesystem. Message written - is intended to be brief final status, such as an assertion - failure message. Will be truncated by the node if greater - than 4096 bytes. The total message length across all containers - will be limited to 12kb. Defaults to /dev/termination-log. - Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination message should - be populated. File will use the contents of terminationMessagePath - to populate the container status message on both success - and failure. FallbackToLogsOnError will use the last chunk - of container log output if the termination message file - is empty and the container exited with an error. The log - output is limited to 2048 bytes or 80 lines, whichever - is smaller. Defaults to File. Cannot be updated. - type: string - tty: - description: Whether this container should allocate a TTY - for itself, also requires 'stdin' to be true. Default - is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of block devices - to be used by the container. - items: - description: volumeDevice describes a mapping of a raw - block device within a container. - properties: - devicePath: - description: devicePath is the path inside of the - container that the device will be mapped to. - type: string - name: - description: name must match the name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - volumeMounts: - description: Pod volumes to mount into the container's filesystem. - Cannot be updated. - items: - description: VolumeMount describes a mounting of a Volume - within a container. - properties: - mountPath: - description: Path within the container at which the - volume should be mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines how mounts - are propagated from the host to container and the - other way around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: Mounted read-only if true, read-write - otherwise (false or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume from which the - container's volume should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within the volume from - which the container's volume should be mounted. - Behaves similarly to SubPath but environment variable - references $(VAR_NAME) are expanded using the container's - environment. Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - workingDir: - description: Container's working directory. If not specified, - the container runtime's default will be used, which might - be configured in the container image. Cannot be updated. - type: string - required: - - name - type: object - type: array - dnsConfig: - description: Specifies the DNS parameters of a pod. Parameters - specified here will be merged to the generated DNS configuration - based on DNSPolicy. - properties: - nameservers: - description: A list of DNS name server IP addresses. This - will be appended to the base nameservers generated from - DNSPolicy. Duplicated nameservers will be removed. - items: - type: string - type: array - options: - description: A list of DNS resolver options. This will be - merged with the base options generated from DNSPolicy. Duplicated - entries will be removed. Resolution options given in Options - will override those that appear in the base DNSPolicy. - items: - description: PodDNSConfigOption defines DNS resolver options - of a pod. - properties: - name: - description: Required. - type: string - value: - type: string - type: object - type: array - searches: - description: A list of DNS search domains for host-name lookup. - This will be appended to the base search paths generated - from DNSPolicy. Duplicated search paths will be removed. - items: - type: string - type: array - type: object - dnsPolicy: - description: Set DNS policy for the pod. Defaults to "ClusterFirst". - Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', - 'Default' or 'None'. DNS parameters given in DNSConfig will - be merged with the policy selected with DNSPolicy. To have DNS - options set along with hostNetwork, you have to specify DNS - policy explicitly to 'ClusterFirstWithHostNet'. - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information - about services should be injected into pod''s environment variables, - matching the syntax of Docker links. Optional: Defaults to true.' - type: boolean - ephemeralContainers: - description: List of ephemeral containers run in this pod. Ephemeral - containers may be run in an existing pod to perform user-initiated - actions such as debugging. This list cannot be specified when - creating a pod, and it cannot be modified by updating the pod - spec. In order to add an ephemeral container to an existing - pod, use the pod's ephemeralcontainers subresource. - items: - description: "An EphemeralContainer is a temporary container - that you may add to an existing Pod for user-initiated activities - such as debugging. Ephemeral containers have no resource or - scheduling guarantees, and they will not be restarted when - they exit or when a Pod is removed or restarted. The kubelet - may evict a Pod if an ephemeral container causes the Pod to - exceed its resource allocation. \n To add an ephemeral container, - use the ephemeralcontainers subresource of an existing Pod. - Ephemeral containers may not be removed or restarted." - properties: - args: - description: 'Arguments to the entrypoint. The image''s - CMD is used if this is not provided. Variable references - $(VAR_NAME) are expanded using the container''s environment. - If a variable cannot be resolved, the reference in the - input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) - syntax: i.e. "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never be expanded, - regardless of whether the variable exists or not. Cannot - be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - command: - description: 'Entrypoint array. Not executed within a shell. - The image''s ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the - container''s environment. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double - $$ are reduced to a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". Escaped references will - never be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - env: - description: List of environment variables to set in the - container. Cannot be updated. - items: - description: EnvVar represents an environment variable - present in a Container. - properties: - name: - description: Name of the environment variable. Must - be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are - expanded using the previously defined environment - variables in the container and any service environment - variables. If a variable cannot be resolved, the - reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless of - whether the variable exists or not. Defaults to - "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports - metadata.name, metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, spec.nodeName, - spec.serviceAccountName, status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the - pod's namespace - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret or - its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - envFrom: - description: List of sources to populate environment variables - in the container. The keys defined within a source must - be a C_IDENTIFIER. All invalid keys will be reported as - an event when the container is starting. When a key exists - in multiple sources, the value associated with the last - source will take precedence. Values defined by an Env - with a duplicate key will take precedence. Cannot be updated. - items: - description: EnvFromSource represents the source of a - set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the ConfigMap must - be defined - type: boolean - type: object - prefix: - description: An optional identifier to prepend to - each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the Secret must be - defined - type: boolean - type: object - type: object - type: array - image: - description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Lifecycle is not allowed for ephemeral containers. - properties: - postStart: - description: 'PostStart is called immediately after - a container is created. If the handler fails, the - container is terminated and restarted according to - its restart policy. Other management of the container - blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately before a - container is terminated due to an API request or management - event such as liveness/startup probe failure, preemption, - resource contention, etc. The handler is not called - if the container crashes or exits. The Pod''s termination - grace period countdown begins before the PreStop hook - is executed. Regardless of the outcome of the handler, - the container will eventually terminate within the - Pod''s termination grace period (unless delayed by - finalizers). Other management of the container blocks - until the hook completes or until the termination - grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: Probes are not allowed for ephemeral containers. - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the ephemeral container specified as - a DNS_LABEL. This name must be unique among all containers, - init containers and ephemeral containers. - type: string - ports: - description: Ports are not allowed for ephemeral containers. - items: - description: ContainerPort represents a network port in - a single container. - properties: - containerPort: - description: Number of port to expose on the pod's - IP address. This must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the external port - to. - type: string - hostPort: - description: Number of port to expose on the host. - If specified, this must be a valid port number, - 0 < x < 65536. If HostNetwork is specified, this - must match ContainerPort. Most containers do not - need this. - format: int32 - type: integer - name: - description: If specified, this must be an IANA_SVC_NAME - and unique within the pod. Each named port in a - pod must have a unique name. Name for the port that - can be referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must be UDP, TCP, - or SCTP. Defaults to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: Probes are not allowed for ephemeral containers. - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: Resources are not allowed for ephemeral containers. - Ephemeral containers use spare resources already allocated - to the pod. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of - compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is omitted - for a container, it defaults to Limits if that is - explicitly specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'Optional: SecurityContext defines the security - options the ephemeral container should be run with. If - set, the fields of SecurityContext override the equivalent - fields of PodSecurityContext.' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation controls whether - a process can gain more privileges than its parent - process. This bool directly controls if the no_new_privs - flag will be set on the container process. AllowPrivilegeEscalation - is true always when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this field cannot be - set when spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop when running - containers. Defaults to the default set of capabilities - granted by the container runtime. Note that this field - cannot be set when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - type: object - privileged: - description: Run container in privileged mode. Processes - in privileged containers are essentially equivalent - to root on the host. Defaults to false. Note that - this field cannot be set when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the type of proc mount - to use for the containers. The default is DefaultProcMount - which uses the container runtime defaults for readonly - paths and masked paths. This requires the ProcMountType - feature flag to be enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has a read-only - root filesystem. Default is false. Note that this - field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint of the container - process. Uses runtime default if unset. May also be - set in PodSecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run as - a non-root user. If true, the Kubelet will validate - the image at runtime to ensure that it does not run - as UID 0 (root) and fail to start the container if - it does. If unset or false, no such validation will - be performed. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the container - process. Defaults to user specified in image metadata - if unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to the - container. If unspecified, the container runtime will - allocate a random SELinux context for each container. May - also be set in PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name is - windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by this container. - If seccomp options are provided at both the pod & - container level, the container options override the - pod options. Note that this field cannot be set when - spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. - The profile must be preconfigured on the node - to work. Must be a descending path, relative to - the kubelet's configured seccomp profile location. - Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: \n - Localhost - a profile defined in a file on the - node should be used. RuntimeDefault - the container - runtime default profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings applied to - all containers. If unspecified, the options from the - PodSecurityContext will be used. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA - admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential spec - named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name - of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. This - field is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the feature - flag will result in errors when validating the - Pod. All of a Pod's containers must have the same - effective HostProcess value (it is not allowed - to have a mix of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess is true - then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the - entrypoint of the container process. Defaults - to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: Probes are not allowed for ephemeral containers. - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this container should allocate a buffer - for stdin in the container runtime. If this is not set, - reads from stdin in the container will always result in - EOF. Default is false. - type: boolean - stdinOnce: - description: Whether the container runtime should close - the stdin channel after it has been opened by a single - attach. When stdin is true the stdin stream will remain - open across multiple attach sessions. If stdinOnce is - set to true, stdin is opened on container start, is empty - until the first client attaches to stdin, and then remains - open and accepts data until the client disconnects, at - which time stdin is closed and remains closed until the - container is restarted. If this flag is false, a container - processes that reads from stdin will never receive an - EOF. Default is false - type: boolean - targetContainerName: - description: "If set, the name of the container from PodSpec - that this ephemeral container targets. The ephemeral container - will be run in the namespaces (IPC, PID, etc) of this - container. If not set then the ephemeral container uses - the namespaces configured in the Pod spec. \n The container - runtime must implement support for this feature. If the - runtime does not support namespace targeting then the - result of setting this field is undefined." - type: string - terminationMessagePath: - description: 'Optional: Path at which the file to which - the container''s termination message will be written is - mounted into the container''s filesystem. Message written - is intended to be brief final status, such as an assertion - failure message. Will be truncated by the node if greater - than 4096 bytes. The total message length across all containers - will be limited to 12kb. Defaults to /dev/termination-log. - Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination message should - be populated. File will use the contents of terminationMessagePath - to populate the container status message on both success - and failure. FallbackToLogsOnError will use the last chunk - of container log output if the termination message file - is empty and the container exited with an error. The log - output is limited to 2048 bytes or 80 lines, whichever - is smaller. Defaults to File. Cannot be updated. - type: string - tty: - description: Whether this container should allocate a TTY - for itself, also requires 'stdin' to be true. Default - is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of block devices - to be used by the container. - items: - description: volumeDevice describes a mapping of a raw - block device within a container. - properties: - devicePath: - description: devicePath is the path inside of the - container that the device will be mapped to. - type: string - name: - description: name must match the name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - volumeMounts: - description: Pod volumes to mount into the container's filesystem. - Subpath mounts are not allowed for ephemeral containers. - Cannot be updated. - items: - description: VolumeMount describes a mounting of a Volume - within a container. - properties: - mountPath: - description: Path within the container at which the - volume should be mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines how mounts - are propagated from the host to container and the - other way around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: Mounted read-only if true, read-write - otherwise (false or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume from which the - container's volume should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within the volume from - which the container's volume should be mounted. - Behaves similarly to SubPath but environment variable - references $(VAR_NAME) are expanded using the container's - environment. Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - workingDir: - description: Container's working directory. If not specified, - the container runtime's default will be used, which might - be configured in the container image. Cannot be updated. - type: string - required: - - name - type: object - type: array - hostAliases: - description: HostAliases is an optional list of hosts and IPs - that will be injected into the pod's hosts file if specified. - This is only valid for non-hostNetwork pods. - items: - description: HostAlias holds the mapping between IP and hostnames - that will be injected as an entry in the pod's hosts file. - properties: - hostnames: - description: Hostnames for the above IP address. - items: - type: string - type: array - ip: - description: IP address of the host file entry. - type: string - type: object - type: array - hostIPC: - description: 'Use the host''s ipc namespace. Optional: Default - to false.' - type: boolean - hostNetwork: - description: Host networking requested for this pod. Use the host's - network namespace. If this option is set, the ports that will - be used must be specified. Default to false. - type: boolean - hostPID: - description: 'Use the host''s pid namespace. Optional: Default - to false.' - type: boolean - hostUsers: - description: 'Use the host''s user namespace. Optional: Default - to true. If set to true or not present, the pod will be run - in the host user namespace, useful for when the pod needs a - feature only available to the host user namespace, such as loading - a kernel module with CAP_SYS_MODULE. When set to false, a new - userns is created for the pod. Setting false is useful for mitigating - container breakout vulnerabilities even allowing users to run - their containers as root without actually having root privileges - on the host. This field is alpha-level and is only honored by - servers that enable the UserNamespacesSupport feature.' - type: boolean - hostname: - description: Specifies the hostname of the Pod If not specified, - the pod's hostname will be set to a system-defined value. - type: string - imagePullSecrets: - description: 'ImagePullSecrets is an optional list of references - to secrets in the same namespace to use for pulling any of the - images used by this PodSpec. If specified, these secrets will - be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' - items: - description: LocalObjectReference contains enough information - to let you locate the referenced object inside the same namespace. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - type: object - type: array - initContainers: - description: 'List of initialization containers belonging to the - pod. Init containers are executed in order prior to containers - being started. If any init container fails, the pod is considered - to have failed and is handled according to its restartPolicy. - The name for an init container or normal container must be unique - among all containers. Init containers may not have Lifecycle - actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into - account during scheduling by finding the highest request/limit - for each resource type, and then using the max of of that value - or the sum of the normal containers. Limits are applied to init - containers in a similar fashion. Init containers cannot currently - be added or removed. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' - items: - description: A single application container that you want to - run within a pod. - properties: - args: - description: 'Arguments to the entrypoint. The container - image''s CMD is used if this is not provided. Variable - references $(VAR_NAME) are expanded using the container''s - environment. If a variable cannot be resolved, the reference - in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) - syntax: i.e. "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never be expanded, - regardless of whether the variable exists or not. Cannot - be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - command: - description: 'Entrypoint array. Not executed within a shell. - The container image''s ENTRYPOINT is used if this is not - provided. Variable references $(VAR_NAME) are expanded - using the container''s environment. If a variable cannot - be resolved, the reference in the input string will be - unchanged. Double $$ are reduced to a single $, which - allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless of whether - the variable exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - env: - description: List of environment variables to set in the - container. Cannot be updated. - items: - description: EnvVar represents an environment variable - present in a Container. - properties: - name: - description: Name of the environment variable. Must - be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are - expanded using the previously defined environment - variables in the container and any service environment - variables. If a variable cannot be resolved, the - reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless of - whether the variable exists or not. Defaults to - "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports - metadata.name, metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, spec.nodeName, - spec.serviceAccountName, status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the - pod's namespace - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret or - its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - envFrom: - description: List of sources to populate environment variables - in the container. The keys defined within a source must - be a C_IDENTIFIER. All invalid keys will be reported as - an event when the container is starting. When a key exists - in multiple sources, the value associated with the last - source will take precedence. Values defined by an Env - with a duplicate key will take precedence. Cannot be updated. - items: - description: EnvFromSource represents the source of a - set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the ConfigMap must - be defined - type: boolean - type: object - prefix: - description: An optional identifier to prepend to - each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether the Secret must be - defined - type: boolean - type: object - type: object - type: array - image: - description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management - to default or override container images in workload controllers - like Deployments and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management system should take - in response to container lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately after - a container is created. If the handler fails, the - container is terminated and restarted according to - its restart policy. Other management of the container - blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately before a - container is terminated due to an API request or management - event such as liveness/startup probe failure, preemption, - resource contention, etc. The handler is not called - if the container crashes or exits. The Pod''s termination - grace period countdown begins before the PreStop hook - is executed. Regardless of the outcome of the handler, - the container will eventually terminate within the - Pod''s termination grace period (unless delayed by - finalizers). Other management of the container blocks - until the hook completes or until the termination - grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to - execute inside the container, the working - directory for the command is root ('/') in - the container's filesystem. The command is - simply exec'd, it is not run inside a shell, - so traditional shell instructions ('|', etc) - won't work. To use a shell, you need to explicitly - call out to that shell. Exit status of 0 is - treated as live/healthy and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the http request - to perform. - properties: - host: - description: Host name to connect to, defaults - to the pod IP. You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom - header to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to - the host. Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket is NOT supported - as a LifecycleHandler and kept for the backward - compatibility. There are no validation of this - field and lifecycle hooks will fail in runtime - when tcp handler is specified. - properties: - host: - description: 'Optional: Host name to connect - to, defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of container liveness. Container - will be restarted if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: List of ports to expose from the container. - Not specifying a port here DOES NOT prevent that port - from being exposed. Any port which is listening on the - default "0.0.0.0" address inside a container will be accessible - from the network. Modifying this array with strategic - merge patch may corrupt the data. For more information - See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - items: - description: ContainerPort represents a network port in - a single container. - properties: - containerPort: - description: Number of port to expose on the pod's - IP address. This must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind the external port - to. - type: string - hostPort: - description: Number of port to expose on the host. - If specified, this must be a valid port number, - 0 < x < 65536. If HostNetwork is specified, this - must match ContainerPort. Most containers do not - need this. - format: int32 - type: integer - name: - description: If specified, this must be an IANA_SVC_NAME - and unique within the pod. Each named port in a - pod must have a unique name. Name for the port that - can be referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must be UDP, TCP, - or SCTP. Defaults to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of container service readiness. - Container will be removed from service endpoints if the - probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required by this container. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount of - compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is omitted - for a container, it defaults to Limits if that is - explicitly specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the security options - the container should be run with. If set, the fields of - SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation controls whether - a process can gain more privileges than its parent - process. This bool directly controls if the no_new_privs - flag will be set on the container process. AllowPrivilegeEscalation - is true always when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this field cannot be - set when spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop when running - containers. Defaults to the default set of capabilities - granted by the container runtime. Note that this field - cannot be set when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent POSIX capabilities - type - type: string - type: array - type: object - privileged: - description: Run container in privileged mode. Processes - in privileged containers are essentially equivalent - to root on the host. Defaults to false. Note that - this field cannot be set when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the type of proc mount - to use for the containers. The default is DefaultProcMount - which uses the container runtime defaults for readonly - paths and masked paths. This requires the ProcMountType - feature flag to be enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container has a read-only - root filesystem. Default is false. Note that this - field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint of the container - process. Uses runtime default if unset. May also be - set in PodSecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run as - a non-root user. If true, the Kubelet will validate - the image at runtime to ensure that it does not run - as UID 0 (root) and fail to start the container if - it does. If unset or false, no such validation will - be performed. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the container - process. Defaults to user specified in image metadata - if unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to the - container. If unspecified, the container runtime will - allocate a random SELinux context for each container. May - also be set in PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence. Note - that this field cannot be set when spec.os.name is - windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by this container. - If seccomp options are provided at both the pod & - container level, the container options override the - pod options. Note that this field cannot be set when - spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. - The profile must be preconfigured on the node - to work. Must be a descending path, relative to - the kubelet's configured seccomp profile location. - Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: \n - Localhost - a profile defined in a file on the - node should be used. RuntimeDefault - the container - runtime default profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings applied to - all containers. If unspecified, the options from the - PodSecurityContext will be used. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA - admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential spec - named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name - of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. This - field is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the feature - flag will result in errors when validating the - Pod. All of a Pod's containers must have the same - effective HostProcess value (it is not allowed - to have a mix of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess is true - then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the - entrypoint of the container process. Defaults - to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that the Pod has successfully - initialized. If specified, no other probes are executed - until this completes successfully. If this probe fails, - the Pod will be restarted, just as if the livenessProbe - failed. This can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, when it might - take a long time to load data or warm a cache, than during - steady-state operation. This cannot be updated. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action to take. - properties: - command: - description: Command is the command line to execute - inside the container, the working directory for - the command is root ('/') in the container's - filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions - ('|', etc) won't work. To use a shell, you need - to explicitly call out to that shell. Exit status - of 0 is treated as live/healthy and non-zero is - unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures for the probe - to be considered failed after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action involving a GRPC - port. This is a beta field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the gRPC service. Number - must be in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name of the service - to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the default behavior - is defined by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http request to perform. - properties: - host: - description: Host name to connect to, defaults to - the pod IP. You probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. - HTTP allows repeated headers. - items: - description: HTTPHeader describes a custom header - to be used in HTTP probes - properties: - name: - description: The header field name - type: string - value: - description: The header field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting to the - host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after the container - has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - Default to 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe - to be considered successful after having failed. Defaults - to 1. Must be 1 for liveness and startup. Minimum - value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an action involving - a TCP port. - properties: - host: - description: 'Optional: Host name to connect to, - defaults to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the port to access - on the container. Number must be in the range - 1 to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs - to terminate gracefully upon probe failure. The grace - period is the duration in seconds after the processes - running in the pod are sent a termination signal and - the time when the processes are forcibly halted with - a kill signal. Set this value longer than the expected - cleanup time for your process. If this value is nil, - the pod's terminationGracePeriodSeconds will be used. - Otherwise, this value overrides the value provided - by the pod spec. Value must be non-negative integer. - The value zero indicates stop immediately via the - kill signal (no opportunity to shut down). This is - a beta field and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after which the probe - times out. Defaults to 1 second. Minimum value is - 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this container should allocate a buffer - for stdin in the container runtime. If this is not set, - reads from stdin in the container will always result in - EOF. Default is false. - type: boolean - stdinOnce: - description: Whether the container runtime should close - the stdin channel after it has been opened by a single - attach. When stdin is true the stdin stream will remain - open across multiple attach sessions. If stdinOnce is - set to true, stdin is opened on container start, is empty - until the first client attaches to stdin, and then remains - open and accepts data until the client disconnects, at - which time stdin is closed and remains closed until the - container is restarted. If this flag is false, a container - processes that reads from stdin will never receive an - EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which the file to which - the container''s termination message will be written is - mounted into the container''s filesystem. Message written - is intended to be brief final status, such as an assertion - failure message. Will be truncated by the node if greater - than 4096 bytes. The total message length across all containers - will be limited to 12kb. Defaults to /dev/termination-log. - Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination message should - be populated. File will use the contents of terminationMessagePath - to populate the container status message on both success - and failure. FallbackToLogsOnError will use the last chunk - of container log output if the termination message file - is empty and the container exited with an error. The log - output is limited to 2048 bytes or 80 lines, whichever - is smaller. Defaults to File. Cannot be updated. - type: string - tty: - description: Whether this container should allocate a TTY - for itself, also requires 'stdin' to be true. Default - is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of block devices - to be used by the container. - items: - description: volumeDevice describes a mapping of a raw - block device within a container. - properties: - devicePath: - description: devicePath is the path inside of the - container that the device will be mapped to. - type: string - name: - description: name must match the name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - volumeMounts: - description: Pod volumes to mount into the container's filesystem. - Cannot be updated. - items: - description: VolumeMount describes a mounting of a Volume - within a container. - properties: - mountPath: - description: Path within the container at which the - volume should be mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines how mounts - are propagated from the host to container and the - other way around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: Mounted read-only if true, read-write - otherwise (false or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume from which the - container's volume should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within the volume from - which the container's volume should be mounted. - Behaves similarly to SubPath but environment variable - references $(VAR_NAME) are expanded using the container's - environment. Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - workingDir: - description: Container's working directory. If not specified, - the container runtime's default will be used, which might - be configured in the container image. Cannot be updated. - type: string - required: - - name - type: object - type: array - nodeName: - description: NodeName is a request to schedule this pod onto a - specific node. If it is non-empty, the scheduler simply schedules - this pod onto that node, assuming that it fits resource requirements. - type: string - nodeSelector: - additionalProperties: - type: string - description: 'NodeSelector is a selector which must be true for - the pod to fit on a node. Selector which must match a node''s - labels for the pod to be scheduled on that node. More info: - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - x-kubernetes-map-type: atomic - os: - description: "Specifies the OS of the containers in the pod. Some - pod and container fields are restricted if this is set. \n If - the OS field is set to linux, the following fields must be unset: - -securityContext.windowsOptions \n If the OS field is set to - windows, following fields must be unset: - spec.hostPID - spec.hostIPC - - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - - spec.securityContext.sysctls - spec.shareProcessNamespace - - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - - spec.containers[*].securityContext.readOnlyRootFilesystem - - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - - spec.containers[*].securityContext.runAsGroup" - properties: - name: - description: 'Name is the name of the operating system. The - currently supported values are linux and windows. Additional - value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration - Clients should expect to handle additional values and treat - unrecognized values in this field as os: null' - type: string - required: - - name - type: object - overhead: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Overhead represents the resource overhead associated - with running a pod for a given RuntimeClass. This field will - be autopopulated at admission time by the RuntimeClass admission - controller. If the RuntimeClass admission controller is enabled, - overhead must not be set in Pod create requests. The RuntimeClass - admission controller will reject Pod create requests which have - the overhead already set. If RuntimeClass is configured and - selected in the PodSpec, Overhead will be set to the value defined - in the corresponding RuntimeClass, otherwise it will remain - unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' - type: object - preemptionPolicy: - description: PreemptionPolicy is the Policy for preempting pods - with lower priority. One of Never, PreemptLowerPriority. Defaults - to PreemptLowerPriority if unset. - type: string - priority: - description: The priority value. Various system components use - this field to find the priority of the pod. When Priority Admission - Controller is enabled, it prevents users from setting this field. - The admission controller populates this field from PriorityClassName. - The higher the value, the higher the priority. - format: int32 - type: integer - priorityClassName: - description: If specified, indicates the pod's priority. "system-node-critical" - and "system-cluster-critical" are two special keywords which - indicate the highest priorities with the former being the highest - priority. Any other name must be defined by creating a PriorityClass - object with that name. If not specified, the pod priority will - be default or zero if there is no default. - type: string - readinessGates: - description: 'If specified, all readiness gates will be evaluated - for pod readiness. A pod is ready when all its containers are - ready AND all conditions specified in the readiness gates have - status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' - items: - description: PodReadinessGate contains the reference to a pod - condition - properties: - conditionType: - description: ConditionType refers to a condition in the - pod's condition list with matching type. - type: string - required: - - conditionType - type: object - type: array - restartPolicy: - description: 'Restart policy for all containers within the pod. - One of Always, OnFailure, Never. Default to Always. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' - type: string - runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass object - in the node.k8s.io group, which should be used to run this pod. If - no RuntimeClass resource matches the named class, the pod will - not be run. If unset or empty, the "legacy" RuntimeClass will - be used, which is an implicit class with an empty definition - that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' - type: string - schedulerName: - description: If specified, the pod will be dispatched by specified - scheduler. If not specified, the pod will be dispatched by default - scheduler. - type: string - securityContext: - description: 'SecurityContext holds pod-level security attributes - and common container settings. Optional: Defaults to empty. See - type description for default values of each field.' - properties: - fsGroup: - description: "A special supplemental group that applies to - all containers in a pod. Some volume types allow the Kubelet - to change the ownership of that volume to be owned by the - pod: \n 1. The owning GID will be the FSGroup 2. The setgid - bit is set (new files created in the volume will be owned - by FSGroup) 3. The permission bits are OR'd with rw-rw---- - \n If unset, the Kubelet will not modify the ownership and - permissions of any volume. Note that this field cannot be - set when spec.os.name is windows." - format: int64 - type: integer - fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior of changing - ownership and permission of the volume before being exposed - inside Pod. This field will only apply to volume types which - support fsGroup based ownership(and permissions). It will - have no effect on ephemeral volume types such as: secret, - configmaps and emptydir. Valid values are "OnRootMismatch" - and "Always". If not specified, "Always" is used. Note that - this field cannot be set when spec.os.name is windows.' - type: string - runAsGroup: - description: The GID to run the entrypoint of the container - process. Uses runtime default if unset. May also be set - in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. Note that this field - cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run as a non-root - user. If true, the Kubelet will validate the image at runtime - to ensure that it does not run as UID 0 (root) and fail - to start the container if it does. If unset or false, no - such validation will be performed. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, the - value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the container - process. Defaults to user specified in image metadata if - unspecified. May also be set in SecurityContext. If set - in both SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence for that container. - Note that this field cannot be set when spec.os.name is - windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random - SELinux context for each container. May also be set in - SecurityContext. If set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence - for that container. Note that this field cannot be set when - spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies - to the container. - type: string - role: - description: Role is a SELinux role label that applies - to the container. - type: string - type: - description: Type is a SELinux type label that applies - to the container. - type: string - user: - description: User is a SELinux user label that applies - to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by the containers - in this pod. Note that this field cannot be set when spec.os.name - is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile defined - in a file on the node should be used. The profile must - be preconfigured on the node to work. Must be a descending - path, relative to the kubelet's configured seccomp profile - location. Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp profile - will be applied. Valid options are: \n Localhost - a - profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile - should be used. Unconfined - no profile should be applied." - type: string - required: - - type - type: object - supplementalGroups: - description: A list of groups applied to the first process - run in each container, in addition to the container's primary - GID. If unspecified, no groups will be added to any container. - Note that this field cannot be set when spec.os.name is - windows. - items: - format: int64 - type: integer - type: array - sysctls: - description: Sysctls hold a list of namespaced sysctls used - for the pod. Pods with unsupported sysctls (by the container - runtime) might fail to launch. Note that this field cannot - be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - windowsOptions: - description: The Windows specific settings applied to all - containers. If unspecified, the options within a container's - SecurityContext will be used. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence. Note that this field cannot be set when - spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA admission - webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential spec named - by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name of the - GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container should - be run as a 'Host Process' container. This field is - alpha-level and will only be honored by components that - enable the WindowsHostProcessContainers feature flag. - Setting this field without the feature flag will result - in errors when validating the Pod. All of a Pod's containers - must have the same effective HostProcess value (it is - not allowed to have a mix of HostProcess containers - and non-HostProcess containers). In addition, if HostProcess - is true then HostNetwork must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the entrypoint - of the container process. Defaults to the user specified - in image metadata if unspecified. May also be set in - PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - serviceAccount: - description: 'DeprecatedServiceAccount is a depreciated alias - for ServiceAccountName. Deprecated: Use serviceAccountName instead.' - type: string - serviceAccountName: - description: 'ServiceAccountName is the name of the ServiceAccount - to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' - type: string - setHostnameAsFQDN: - description: If true the pod's hostname will be configured as - the pod's FQDN, rather than the leaf name (the default). In - Linux containers, this means setting the FQDN in the hostname - field of the kernel (the nodename field of struct utsname). - In Windows containers, this means setting the registry value - of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters - to FQDN. If a pod does not have FQDN, this has no effect. Default - to false. - type: boolean - shareProcessNamespace: - description: 'Share a single process namespace between all of - the containers in a pod. When this is set containers will be - able to view and signal processes from other containers in the - same pod, and the first process in each container will not be - assigned PID 1. HostPID and ShareProcessNamespace cannot both - be set. Optional: Default to false.' - type: boolean - subdomain: - description: If specified, the fully qualified Pod hostname will - be "...svc.". - If not specified, the pod will not have a domainname at all. - type: string - terminationGracePeriodSeconds: - description: Optional duration in seconds the pod needs to terminate - gracefully. May be decreased in delete request. Value must be - non-negative integer. The value zero indicates stop immediately - via the kill signal (no opportunity to shut down). If this value - is nil, the default grace period will be used instead. The grace - period is the duration in seconds after the processes running - in the pod are sent a termination signal and the time when the - processes are forcibly halted with a kill signal. Set this value - longer than the expected cleanup time for your process. Defaults - to 30 seconds. - format: int64 - type: integer - tolerations: - description: If specified, the pod's tolerations. - items: - description: The pod this Toleration is attached to tolerates - any taint that matches the triple using - the matching operator . - properties: - effect: - description: Effect indicates the taint effect to match. - Empty means match all taint effects. When specified, allowed - values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the toleration applies - to. Empty means match all taint keys. If the key is empty, - operator must be Exists; this combination means to match - all values and all keys. - type: string - operator: - description: Operator represents a key's relationship to - the value. Valid operators are Exists and Equal. Defaults - to Equal. Exists is equivalent to wildcard for value, - so that a pod can tolerate all taints of a particular - category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period of - time the toleration (which must be of effect NoExecute, - otherwise this field is ignored) tolerates the taint. - By default, it is not set, which means tolerate the taint - forever (do not evict). Zero and negative values will - be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration matches - to. If the operator is Exists, the value should be empty, - otherwise just a regular string. - type: string - type: object - type: array - topologySpreadConstraints: - description: TopologySpreadConstraints describes how a group of - pods ought to spread across topology domains. Scheduler will - schedule pods in a way which abides by the constraints. All - topologySpreadConstraints are ANDed. - items: - description: TopologySpreadConstraint specifies how to spread - matching pods among the given topology. - properties: - labelSelector: - description: LabelSelector is used to find matching pods. - Pods that match this label selector are counted to determine - the number of pods in their corresponding topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists - or DoesNotExist, the values array must be empty. - This array is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. - type: object - type: object - matchLabelKeys: - description: MatchLabelKeys is a set of pod label keys to - select the pods over which spreading will be calculated. - The keys are used to lookup values from the incoming pod - labels, those key-value labels are ANDed with labelSelector - to select the group of existing pods over which spreading - will be calculated for the incoming pod. Keys that don't - exist in the incoming pod labels will be ignored. A null - or empty list means only match against labelSelector. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: 'MaxSkew describes the degree to which pods - may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, - it is the maximum permitted difference between the number - of matching pods in the target topology and the global - minimum. The global minimum is the minimum number of matching - pods in an eligible domain or zero if the number of eligible - domains is less than MinDomains. For example, in a 3-zone - cluster, MaxSkew is set to 1, and pods with the same labelSelector - spread as 2/2/1: In this case, the global minimum is 1. - | zone1 | zone2 | zone3 | | P P | P P | P | - - if MaxSkew is 1, incoming pod can only be scheduled to - zone3 to become 2/2/2; scheduling it onto zone1(zone2) - would make the ActualSkew(3-1) on zone1(zone2) violate - MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled - onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to topologies that - satisfy it. It''s a required field. Default value is 1 - and 0 is not allowed.' - format: int32 - type: integer - minDomains: - description: "MinDomains indicates a minimum number of eligible - domains. When the number of eligible domains with matching - topology keys is less than minDomains, Pod Topology Spread - treats \"global minimum\" as 0, and then the calculation - of Skew is performed. And when the number of eligible - domains with matching topology keys equals or greater - than minDomains, this value has no effect on scheduling. - As a result, when the number of eligible domains is less - than minDomains, scheduler won't schedule more than maxSkew - Pods to those domains. If value is nil, the constraint - behaves as if MinDomains is equal to 1. Valid values are - integers greater than 0. When value is not nil, WhenUnsatisfiable - must be DoNotSchedule. \n For example, in a 3-zone cluster, - MaxSkew is set to 2, MinDomains is set to 5 and pods with - the same labelSelector spread as 2/2/2: | zone1 | zone2 - | zone3 | | P P | P P | P P | The number of domains - is less than 5(MinDomains), so \"global minimum\" is treated - as 0. In this situation, new pod with the same labelSelector - cannot be scheduled, because computed skew will be 3(3 - - 0) if new Pod is scheduled to any of the three zones, - it will violate MaxSkew. \n This is a beta field and requires - the MinDomainsInPodTopologySpread feature gate to be enabled - (enabled by default)." - format: int32 - type: integer - nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates how we will treat - Pod's nodeAffinity/nodeSelector when calculating pod topology - spread skew. Options are: - Honor: only nodes matching - nodeAffinity/nodeSelector are included in the calculations. - - Ignore: nodeAffinity/nodeSelector are ignored. All nodes - are included in the calculations. \n If this value is - nil, the behavior is equivalent to the Honor policy. This - is a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how we will treat - node taints when calculating pod topology spread skew. - Options are: - Honor: nodes without taints, along with - tainted nodes for which the incoming pod has a toleration, - are included. - Ignore: node taints are ignored. All nodes - are included. \n If this value is nil, the behavior is - equivalent to the Ignore policy. This is a alpha-level - feature enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - topologyKey: - description: TopologyKey is the key of node labels. Nodes - that have a label with this key and identical values are - considered to be in the same topology. We consider each - as a "bucket", and try to put balanced number - of pods into each bucket. We define a domain as a particular - instance of a topology. Also, we define an eligible domain - as a domain whose nodes meet the requirements of nodeAffinityPolicy - and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", - each Node is a domain of that topology. And, if TopologyKey - is "topology.kubernetes.io/zone", each zone is a domain - of that topology. It's a required field. - type: string - whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates how to deal with - a pod if it doesn''t satisfy the spread constraint. - - DoNotSchedule (default) tells the scheduler not to schedule - it. - ScheduleAnyway tells the scheduler to schedule the - pod in any location, but giving higher precedence to - topologies that would help reduce the skew. A constraint - is considered "Unsatisfiable" for an incoming pod if and - only if every possible node assignment for that pod would - violate "MaxSkew" on some topology. For example, in a - 3-zone cluster, MaxSkew is set to 1, and pods with the - same labelSelector spread as 3/1/1: | zone1 | zone2 | - zone3 | | P P P | P | P | If WhenUnsatisfiable - is set to DoNotSchedule, incoming pod can only be scheduled - to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) - on zone2(zone3) satisfies MaxSkew(1). In other words, - the cluster can still be imbalanced, but scheduler won''t - make it *more* imbalanced. It''s a required field.' - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - x-kubernetes-list-map-keys: - - topologyKey - - whenUnsatisfiable - x-kubernetes-list-type: map - volumes: - description: 'List of volumes that can be mounted by containers - belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' - items: - description: Volume represents a named volume in a pod that - may be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents an AWS Disk - resource that is attached to a kubelet''s host machine - and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: 'partition is the partition in the volume - that you want to mount. If omitted, the default is - to mount by volume name. Examples: For volume /dev/sda1, - you specify the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can leave the - property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will force the readOnly - setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of the persistent - disk resource in AWS (Amazon EBS volume). More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure Data Disk mount - on the host and bind mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host Caching mode: - None, Read Only, Read Write.' - type: string - diskName: - description: diskName is the Name of the data disk in - the blob storage - type: string - diskURI: - description: diskURI is the URI of data disk in the - blob storage - type: string - fsType: - description: fsType is Filesystem type to mount. Must - be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are Shared: multiple - blob disks per storage account Dedicated: single - blob disk per storage account Managed: azure managed - data disk (only in managed availability set). defaults - to shared' - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure File Service - mount on the host and bind mount to the pod. - properties: - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of secret that - contains Azure Storage Account Name and Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount on the host - that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors is a collection - of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as the mounted - root, rather than the full Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: SecretFile is - the path to key ring for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef is reference - to the authentication secret for User, default is - empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - user: - description: 'user is optional: User is the rados user - name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume attached - and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points to a secret - object containing parameters used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify the volume in - cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap that should - populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value pair - in the Data field of the referenced ConfigMap will - be projected into the volume as a file whose name - is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. If a - key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the CSI driver that - handles this volume. Consult with your admin for the - correct name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", "ntfs". - If not provided, the empty value is passed to the - associated CSI driver which will determine the default - filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference to - the secret object containing sensitive information - to pass to the CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This field is optional, - and may be empty if no secret is required. If the - secret object contains more than one secret, all secret - references are passed. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. Consult - your driver's documentation for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward API about the - pod that should populate this volume - properties: - defaultMode: - description: 'Optional: mode bits to use on created - files by default. Must be a Optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: Items is a list of downward API volume - file - items: - description: DownwardAPIVolumeFile represents information - to create the file containing the pod field - properties: - fieldRef: - description: 'Required: Selects a field of the - pod: only annotations, labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in - the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used to set - permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode - bits. If not specified, the volume defaultMode - will be used. This might be in conflict with - other options that affect the file mode, like - fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the relative - path name of the file to be created. Must not - be absolute or contain the ''..'' path. Must - be utf-8 encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format of - the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary directory - that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type of storage - medium should back this directory. The default is - "" which means to use the node''s default medium. - Must be an empty string (default) or Memory. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount of local - storage required for this EmptyDir volume. The size - limit is also applicable for memory medium. The maximum - usage on memory medium EmptyDir would be the minimum - value between the SizeLimit specified here and the - sum of memory limits of all containers in a pod. The - default is nil which means that the limit is undefined. - More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume that is handled - by a cluster storage driver. The volume's lifecycle is - tied to the pod that defines it - it will be created before - the pod starts, and deleted when the pod is removed. \n - Use this if: a) the volume is only needed while the pod - runs, b) features of normal volumes like restoring from - snapshot or capacity tracking are needed, c) the storage - driver is specified through a storage class, and d) the - storage driver supports dynamic volume provisioning through - \ a PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection between this - volume type and PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual pod. \n - Use CSI for light-weight local ephemeral volumes if the - CSI driver is meant to be used that way - see the documentation - of the driver for more information. \n A pod can use both - types of ephemeral volumes and persistent volumes at the - same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a stand-alone PVC - to provision the volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of the PVC, i.e. the - PVC will be deleted together with the pod. The name - of the PVC will be `-` where - `` is the name from the `PodSpec.Volumes` - array entry. Pod validation will reject the pod if - the concatenated name is not valid for a PVC (for - example, too long). \n An existing PVC with that name - that is not owned by the pod will *not* be used for - the pod to avoid using an unrelated volume by mistake. - Starting the pod is then blocked until the unrelated - PVC is removed. If such a pre-created PVC is meant - to be used by the pod, the PVC has to updated with - an owner reference to the pod once the pod exists. - Normally this should not be necessary, but it may - be useful when manually reconstructing a broken cluster. - \n This field is read-only and no changes will be - made by Kubernetes to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels and annotations - that will be copied into the PVC when creating - it. No other fields are allowed and will be rejected - during validation. - type: object - spec: - description: The specification for the PersistentVolumeClaim. - The entire content is copied unchanged into the - PVC that gets created from this template. The - same fields as in a PersistentVolumeClaim are - also valid here. - properties: - accessModes: - description: 'accessModes contains the desired - access modes the volume should have. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be used to - specify either: * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external controller - can support the specified data source, it - will create a new volume based on the contents - of the specified data source. If the AnyVolumeDataSource - feature gate is enabled, this field will always - have the same contents as the DataSourceRef - field.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies the object - from which to populate the volume with data, - if a non-empty volume is desired. This may - be any local object from a non-empty API group - (non core object) or a PersistentVolumeClaim - object. When this field is specified, volume - binding will only succeed if the type of the - specified object matches some installed volume - populator or dynamic provisioner. This field - will replace the functionality of the DataSource - field and as such if both fields are non-empty, - they must have the same value. For backwards - compatibility, both fields (DataSource and - DataSourceRef) will be set to the same value - automatically if one of them is empty and - the other is non-empty. There are two important - differences between DataSource and DataSourceRef: - * While DataSource only allows two specific - types of objects, DataSourceRef allows any - non-core object, as well as PersistentVolumeClaim - objects. * While DataSource ignores disallowed - values (dropping them), DataSourceRef preserves - all values, and generates an error if a disallowed - value is specified. (Beta) Using this field - requires the AnyVolumeDataSource feature gate - to be enabled.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the minimum - resources the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than - previous value but must still be higher than - capacity recorded in the status field of the - claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query over - volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is the name of - the StorageClass required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what type of - volume is required by the claim. Value of - Filesystem is implied when not included in - claim spec. - type: string - volumeName: - description: volumeName is the binding reference - to the PersistentVolume backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel resource that - is attached to a kubelet's host machine and then exposed - to the pod. - properties: - fsType: - description: 'fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. TODO: how do we prevent - errors in the filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: FC target worldwide - names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume world wide identifiers - (wwids) Either wwids or combination of targetWWNs - and lun must be set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic volume resource - that is provisioned/attached using an exec based plugin. - properties: - driver: - description: driver is the name of the driver to use - for this volume. - type: string - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The default filesystem - depends on FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this field holds - extra command options if any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults to false - (read/write). ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef is reference - to the secret object containing sensitive information - to pass to the plugin scripts. This may be empty if - no secret object is specified. If the secret object - contains more than one secret, all secrets are passed - to the plugin scripts.' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker volume attached - to a kubelet's host machine. This depends on the Flocker - control service being running - properties: - datasetName: - description: datasetName is Name of the dataset stored - as metadata -> name on the dataset for Flocker should - be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of the dataset. - This is unique identifier of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents a GCE Disk resource - that is attached to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - partition: - description: 'partition is the partition in the volume - that you want to mount. If omitted, the default is - to mount by volume name. Examples: For volume /dev/sda1, - you specify the partition as "1". Similarly, the volume - partition for /dev/sda is "0" (or you can leave the - property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of the PD resource - in GCE. Used to identify the disk in GCE. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository at a particular - revision. DEPRECATED: GitRepo is deprecated. To provision - a container with a git repo, mount an EmptyDir into an - InitContainer that clones the repo using git, then mount - the EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target directory name. - Must not contain or start with '..'. If '.' is supplied, - the volume directory will be the git repository. Otherwise, - if specified, the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash for the specified - revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs mount on - the host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint name that details - Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume path. More - info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force the Glusterfs - volume to be mounted with read-only permissions. Defaults - to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing file or - directory on the host machine that is directly exposed - to the container. This is generally used for system agents - or other privileged things that are allowed to see the - host machine. Most containers will NOT need this. More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can use host - directory mounts and who can/can not mount host directories - as read/write.' - properties: - path: - description: 'path of the directory on the host. If - the path is a symlink, it will follow the link to - the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume Defaults to "" - More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk resource that - is attached to a kubelet''s host machine and then exposed - to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines whether support - iSCSI Discovery CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether support - iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom iSCSI Initiator - Name. If initiatorName is specified with iscsiInterface - simultaneously, new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface Name that - uses an iSCSI transport. Defaults to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target Portal List. - The portal is either an IP or ip_addr:port if the - port is other than default (typically TCP ports 860 - and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force the ReadOnly setting - in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret for iSCSI - target and initiator authentication - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target Portal. The - Portal is either an IP or ip_addr:port if the port - is other than default (typically TCP ports 860 and - 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be a DNS_LABEL and - unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount on the host that - shares a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by the NFS server. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force the NFS export - to be mounted with read-only permissions. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or IP address of - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource represents - a reference to a PersistentVolumeClaim in the same namespace. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly setting - in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets host - machine - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies Photon Controller - persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx volume - attached and mounted on kubelets host machine - properties: - fsType: - description: fSType represents the filesystem type to - mount Must be a filesystem type supported by the host - operating system. Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a Portworx - volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one resources secrets, - configmaps, and downward API - properties: - defaultMode: - description: defaultMode are the mode bits used to set - permissions on created files by default. Must be an - octal value between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this - setting. This might be in conflict with other options - that affect the file mode, like fsGroup, and the result - can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected along - with other supported volume types - properties: - configMap: - description: configMap information about the configMap - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - ConfigMap will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. Paths - must be relative and may not contain the - '..' path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether the - ConfigMap or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information about the - downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used - to set permissions on this file, must - be an octal value between 0000 and - 0777 or a decimal value between 0 - and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can be - other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file to - be created. Must not be absolute or - contain the ''..'' path. Must be utf-8 - encoded. The first item of the relative - path must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of - the container: only resources limits - and requests (limits.cpu, limits.memory, - requests.cpu and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env - vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about the secret - data to project - properties: - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced - Secret will be projected into the volume - as a file whose name is the key and content - is the value. If specified, the listed keys - will be projected into the specified paths, - and unlisted keys will not be present. If - a key is specified which is not present - in the Secret, the volume setup will error - unless it is marked optional. Paths must - be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path - within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode - bits used to set permissions on this - file. Must be an octal value between - 0000 and 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. If not - specified, the volume defaultMode - will be used. This might be in conflict - with other options that affect the - file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May - not be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: audience is the intended audience - of the token. A recipient of a token must - identify itself with an identifier specified - in the audience of the token, and otherwise - should reject the token. The audience defaults - to the identifier of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is the requested - duration of validity of the service account - token. As the token approaches expiration, - the kubelet volume plugin will proactively - rotate the service account token. The kubelet - will start trying to rotate the token if - the token is older than 80 percent of its - time to live or if the token is older than - 24 hours.Defaults to 1 hour and must be - at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative to - the mount point of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte mount on the host - that shares a pod's lifetime - properties: - group: - description: group to map volume access to Default is - no group - type: string - readOnly: - description: readOnly here will force the Quobyte volume - to be mounted with read-only permissions. Defaults - to false. - type: boolean - registry: - description: registry represents a single or multiple - Quobyte Registry services specified as a string as - host:port pair (multiple entries are separated with - commas) which acts as the central registry for volumes - type: string - tenant: - description: tenant owning the given Quobyte volume - in the Backend Used with dynamically provisioned Quobyte - volumes, value is set by the plugin - type: string - user: - description: user to map volume access to Defaults to - serivceaccount user - type: string - volume: - description: volume is a string that references an already - created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block Device mount - on the host that shares a pod''s lifetime. More info: - https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type of the volume - that you want to mount. Tip: Ensure that the filesystem - type is supported by the host operating system. Examples: - "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem from - compromising the machine' - type: string - image: - description: 'image is the rados image name. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key ring for RBDUser. - Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection of Ceph monitors. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. Default is - rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the authentication - secret for RBDUser. If provided overrides keyring. - Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - user: - description: 'user is the rados user name. Default is - admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO persistent volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: gateway is the host address of the ScaleIO - API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name of the ScaleIO - Protection Domain for the configured storage. - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the secret for - ScaleIO user and other sensitive information. If this - is not provided, Login operation will fail. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable SSL communication - with Gateway, default false - type: boolean - storageMode: - description: storageMode indicates whether the storage - for a volume should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO Storage Pool - associated with the protection domain. - type: string - system: - description: system is the name of the storage system - as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of a volume already - created in the ScaleIO system that is associated with - this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that should populate - this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: mode bits used - to set permissions on created files by default. Must - be an octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within the path - are not affected by this setting. This might be in - conflict with other options that affect the file mode, - like fsGroup, and the result can be other mode bits - set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value pair - in the Data field of the referenced Secret will be - projected into the volume as a file whose name is - the key and content is the value. If specified, the - listed keys will be projected into the specified paths, - and unlisted keys will not be present. If a key is - specified which is not present in the Secret, the - volume setup will error unless it is marked optional. - Paths must be relative and may not contain the '..' - path or start with '..'. - items: - description: Maps a string key to a path within a - volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits used - to set permissions on this file. Must be an - octal value between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts both octal - and decimal values, JSON requires decimal values - for mode bits. If not specified, the volume - defaultMode will be used. This might be in conflict - with other options that affect the file mode, - like fsGroup, and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative path of the - file to map the key to. May not be an absolute - path. May not contain the path element '..'. - May not start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether the Secret - or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the secret in - the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS volume attached - and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to mount. - Must be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret to use for - obtaining the StorageOS API credentials. If not specified, - default values will be attempted. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable name of - the StorageOS volume. Volume names are only unique - within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies the scope of - the volume within StorageOS. If no namespace is specified - then the Pod's namespace will be used. This allows - the Kubernetes name scoping to be mirrored within - StorageOS for tighter integration. Set VolumeName - to any name to override the default behaviour. Set - to "default" if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist within - StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere volume attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is filesystem type to mount. Must - be a filesystem type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage Policy Based - Management (SPBM) profile ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the storage Policy - Based Management (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path that identifies - vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - required: - - containers - type: object - prowjob_defaults: - description: ProwJobDefault holds configuration options provided as - defaults in the Prow config - properties: - resultstore_config: - description: ResultStoreConfig specifies parameters for uploading - results to the ResultStore service. - properties: - project_id: - description: ProjectID specifies the ResultStore InvocationAttributes.ProjectID, - used for various quota and GUI access control purposes. - In practice, it is generally the same as the Google Cloud - Project ID or number of the job's GCS storage bucket. Required - to upload results to ResultStore. - type: string - type: object - tenant_id: - type: string - type: object - refs: - description: Refs is the code under test, determined at runtime by - Prow itself - properties: - base_link: - description: BaseLink is a link to the commit identified by BaseSHA. - type: string - base_ref: - type: string - base_sha: - type: string - blobless_fetch: - description: BloblessFetch tells prow to avoid fetching objects - when cloning using the --filter=blob:none flag. If unspecified, - defaults to DecorationConfig.BloblessFetch. - type: boolean - clone_depth: - description: CloneDepth is the depth of the clone that will be - used. A depth of zero will do a full clone. - type: integer - clone_uri: - description: CloneURI is the URI that is used to clone the repository. - If unset, will default to `https://github.com/org/repo.git`. - type: string - org: - description: Org is something like kubernetes or k8s.io - type: string - path_alias: - description: PathAlias is the location under /src where - this repository is cloned. If this is not set, /src/github.com/org/repo - will be used as the default. - type: string - pulls: - items: - description: Pull describes a pull request at a particular point - in time. - properties: - author: - type: string - author_link: - description: AuthorLink links to the author of the pull - request. - type: string - commit_link: - description: CommitLink links to the commit identified by - the SHA. - type: string - head_ref: - description: 'HeadRef is the git ref (branch name) of the - proposed change. This can be more human-readable than - just a PR #, and some tools want this metadata to help - associate the work with a pull request (e.g. some code - scanning services, or chromatic.com).' - type: string - link: - description: Link links to the pull request itself. - type: string - number: - type: integer - ref: - description: 'Ref is git ref can be checked out for a change - for example, github: pull/123/head gerrit: refs/changes/00/123/1' - type: string - sha: - type: string - title: - type: string - required: - - author - - number - - sha - type: object - type: array - repo: - description: Repo is something like test-infra - type: string - repo_link: - description: RepoLink links to the source for Repo. - type: string - skip_fetch_head: - description: SkipFetchHead tells prow to avoid a git fetch - call. Multiheaded repos may need to not make this call. The - git fetch call occurs regardless. - type: boolean - skip_submodules: - description: SkipSubmodules determines if submodules should be - cloned when the job is run. Defaults to false. - type: boolean - workdir: - description: WorkDir defines if the location of the cloned repository - will be used as the default working directory. - type: boolean - required: - - org - - repo - type: object - report: - description: Report determines if the result of this job should be - reported (e.g. status on GitHub, message in Slack, etc.) - type: boolean - reporter_config: - description: ReporterConfig holds reporter-specific configuration - properties: - slack: - properties: - channel: - type: string - host: - type: string - job_states_to_report: - items: - description: ProwJobState specifies whether the job is running - type: string - type: array - report: - description: 'Report is derived from JobStatesToReport, it''s - used for differentiating nil from empty slice, as yaml roundtrip - by design can''t tell the difference when omitempty is supplied. - See https://github.com/kubernetes/test-infra/pull/24168 - for details Priority-wise, it goes by following order: - - `report: true/false`` in job config - `JobStatesToReport: - ` in job config - `report: - true/false`` in global config - `JobStatesToReport:` in - global config' - type: boolean - report_template: - type: string - type: object - type: object - rerun_auth_config: - description: RerunAuthConfig holds information about which users can - rerun the job - properties: - allow_anyone: - description: If AllowAnyone is set to true, any user can rerun - the job - type: boolean - github_orgs: - description: GitHubOrgs contains names of GitHub organizations - whose members can rerun the job - items: - type: string - type: array - github_team_ids: - description: 'GitHubTeams contains IDs of GitHub teams of users - who can rerun the job If you know the name of a team and the - org it belongs to, you can look up its ID using this command, - where the team slug is the hyphenated name: curl -H "Authorization: - token " "https://api.github.com/orgs//teams/" or, to list all teams in a given org, use curl -H "Authorization: - token " "https://api.github.com/orgs//teams"' - items: - type: integer - type: array - github_team_slugs: - description: GitHubTeamSlugs contains slugs and orgs of teams - of users who can rerun the job - items: - properties: - org: - type: string - slug: - type: string - required: - - org - - slug - type: object - type: array - github_users: - description: GitHubUsers contains names of individual users who - can rerun the job - items: - type: string - type: array - type: object - rerun_command: - description: RerunCommand is the command a user would write to trigger - this job on their pull request - type: string - tekton_pipeline_run_spec: - description: TektonPipelineRunSpec provides the basis for running - the test as a pipeline-crd resource https://github.com/tektoncd/pipeline - properties: - v1beta1: - description: PipelineRunSpec defines the desired state of PipelineRun - properties: - params: - description: Params is a list of parameter names and values. - items: - description: Param declares an ParamValues to use for the - parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold a single - string or string array. Used in JSON unmarshalling - so that a single JSON field can accept either an individual - string or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of an - input parameter; Used to distinguish between a - single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - pipelineRef: - description: PipelineRef can be used to refer to a specific - instance of a Pipeline. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton Bundle. - Deprecated: Please use ResolverRef with the bundles - resolver instead.' - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters used to identify - the referenced Tekton resource. Example entries might - include "repo" or "path" but the set of params ultimately - depends on the chosen resolver. - items: - description: Param declares an ParamValues to use for - the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can hold - a single string or string array. Used in JSON - unmarshalling so that a single JSON field can - accept either an individual string or an array - of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of - an input parameter; Used to distinguish between - a single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver that - should perform resolution of the referenced Tekton resource, - such as "git". - type: string - type: object - pipelineSpec: - description: PipelineSpec defines the desired state of Pipeline. - properties: - description: - description: Description is a user-facing description - of the pipeline that may be used to populate a UI. - type: string - finally: - description: Finally declares the list of Tasks that execute - just before leaving the Pipeline i.e. either after all - Tasks are finished executing successfully or after a - failure which would result in ending the Pipeline - items: - description: PipelineTask defines a task in a Pipeline, - passing inputs from both Params and from the output - of previous tasks. - properties: - matrix: - description: Matrix declares parameters used to - fan out this task. - properties: - params: - description: Params is a list of parameters - used to fan out the pipelineTask Params takes - only `Parameters` of type `"array"` Each array - element is supplied to the `PipelineTask` - by substituting `params` of type `"string"` - in the underlying `Task`. The names of the - `params` in the `Matrix` must match the names - of the `params` in the underlying `Task` that - they will be substituting. - items: - description: Param declares an ParamValues - to use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that - can hold a single string or string array. - Used in JSON unmarshalling so that a - single JSON field can accept either - an individual string or an array of - strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - name: - description: Name is the name of this task within - the context of a Pipeline. Name is used as a coordinate - with the `from` and `runAfter` fields to establish - the execution order of tasks relative to one another. - type: string - params: - description: Parameters declares parameters passed - to this task. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the resources given - to this task as inputs and outputs. - properties: - inputs: - description: Inputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: PipelineTaskInputResource maps - the name of a declared PipelineResource - input dependency in a Task to the resource - in the Pipeline's DeclaredPipelineResources - that should be used. This input may come - from a previous task. - properties: - from: - description: From is the list of PipelineTask - names that the resource has to come - from. (Implies an ordering in the execution - graph.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the - DeclaredPipelineResource to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: PipelineTaskOutputResource maps - the name of a declared PipelineResource - output dependency in a Task to the resource - in the Pipeline's DeclaredPipelineResources - that should be used. - properties: - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the - DeclaredPipelineResource to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - type: object - retries: - description: 'Retries represents how many times - this task should be retried in case of task failure: - ConditionSucceeded set to False' - type: integer - runAfter: - description: RunAfter is the list of PipelineTask - names that should be executed before this Task - executes. (Used to force a specific ordering in - graph execution.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - taskRef: - description: TaskRef is a reference to a task definition. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton - Bundle. Deprecated: Please use ResolverRef - with the bundles resolver instead.' - type: string - kind: - description: TaskKind indicates the kind of - the task, namespaced or cluster scoped. - type: string - name: - description: 'Name of the referent; More info: - http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters - used to identify the referenced Tekton resource. - Example entries might include "repo" or "path" - but the set of params ultimately depends on - the chosen resolver. - items: - description: Param declares an ParamValues - to use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that - can hold a single string or string array. - Used in JSON unmarshalling so that a - single JSON field can accept either - an individual string or an array of - strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver - that should perform resolution of the referenced - Tekton resource, such as "git". - type: string - type: object - taskSpec: - description: TaskSpec is a specification of a task - properties: - apiVersion: - type: string - description: - description: Description is a user-facing description - of the task that may be used to populate a - UI. - type: string - kind: - type: string - metadata: - description: PipelineTaskMetadata contains the - labels or annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - params: - description: Params is a list of input parameters - required to run the task. Params must be supplied - as inputs in TaskRuns unless they declare - a default value. - items: - description: ParamSpec defines arbitrary parameters - needed beyond typed inputs (such as resources). - Parameter values are provided by users as - inputs on a TaskRun or PipelineRun. - properties: - default: - description: Default is the value a parameter - takes if no input value is supplied. - If default is set, a Task may be executed - without a supplied value for the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing - description of the parameter that may - be used to populate a UI. - type: string - name: - description: Name declares the name by - which a parameter is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the - struct for object keys - properties: - type: - description: ParamType indicates - the type of an input parameter; - Used to distinguish between a - single string and an array of - strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs - parameter. - type: object - type: - description: Type is the user-specified - type of the parameter. The possible - types are currently "string", "array" - and "object", and "string" is the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources is a list input and output - resource to run the task Resources are represented - in TaskRuns as bindings to instances of PipelineResources. - properties: - inputs: - description: Inputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required - by the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used - to refer to these Resources within the - Task definition, and when provided as - an Input, the Name will be the path - to the volume mounted containing this - Resource as an input (e.g. an input - Resource named `workspace` will be mounted - at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name - by which a resource is referenced - in the definition. Resources may - be referenced by name in the definition - of a Task's steps. - type: string - optional: - description: 'Optional declares the - resource as optional. By default - optional is set to false which makes - a resource required. optional: true - - the resource is considered optional - optional: false - the resource is - considered required (equivalent - of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path - in workspace directory where the - resource will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required - by the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used - to refer to these Resources within the - Task definition, and when provided as - an Input, the Name will be the path - to the volume mounted containing this - Resource as an input (e.g. an input - Resource named `workspace` will be mounted - at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name - by which a resource is referenced - in the definition. Resources may - be referenced by name in the definition - of a Task's steps. - type: string - optional: - description: 'Optional declares the - resource as optional. By default - optional is set to false which makes - a resource required. optional: true - - the resource is considered optional - optional: false - the resource is - considered required (equivalent - of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path - in workspace directory where the - resource will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - type: object - results: - description: Results are values that this Task - can output - items: - description: TaskResult used to describe the - results of a task - properties: - description: - description: Description is a human-readable - description of the result - type: string - name: - description: Name the given name - type: string - properties: - additionalProperties: - description: PropertySpec defines the - struct for object keys - properties: - type: - description: ParamType indicates - the type of an input parameter; - Used to distinguish between a - single string and an array of - strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs - results. - type: object - type: - description: Type is the user-specified - type of the result. The possible type - is currently "string" and will support - "array" in following work. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - sidecars: - description: Sidecars are run alongside the - Task's step containers. They begin before - the steps start and end after the steps complete. - items: - description: Sidecar has nearly the same data - structure as Step but does not have the - ability to timeout. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is - not provided. Variable references $(VAR_NAME) - are expanded using the container''s - environment. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded - using the Sidecar''s environment. If - a variable cannot be resolved, the reference - in the input string will be unchanged. - Double $$ are reduced to a single $, - which allows for escaping the $(VAR_NAME) - syntax: i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the Sidecar. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using - the previously defined environment - variables in the container and - any service environment variables. - If a variable cannot be resolved, - the reference in the input string - will be unchanged. Double $$ are - reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". - Escaped references will never - be expanded, regardless of whether - the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to - select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of - the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the Sidecar. - The keys defined within a source must - be a C_IDENTIFIER. All invalid keys - will be reported as an event when the - Sidecar is starting. When a key exists - in multiple sources, the value associated - with the last source will take precedence. - Values defined by an Env with a duplicate - key will take precedence. Cannot be - updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the - ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image name to be used by - the Sidecar. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management - system should take in response to Sidecar - lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called - immediately after a container is - created. If the handler fails, the - container is terminated and restarted - according to its restart policy. - Other management of the container - blocks until the hook completes. - More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated - due to an API request or management - event such as liveness/startup probe - failure, preemption, resource contention, - etc. The handler is not called if - the container crashes or exits. - The Pod''s termination grace period - countdown begins before the PreStop - hook is executed. Regardless of - the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes - or until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of Sidecar - liveness. Container will be restarted - if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Sidecar specified - as a DNS_LABEL. Each Sidecar in a Task - must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: List of ports to expose from - the Sidecar. Exposing a port here gives - the system additional information about - the network connections a container - uses, but is primarily informational. - Not specifying a port here DOES NOT - prevent that port from being exposed. - Any port which is listening on the default - "0.0.0.0" address inside a container - will be accessible from the network. - Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This - must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 - < x < 65536. If HostNetwork is - specified, this must match ContainerPort. - Most containers do not need this. - format: int32 - type: integer - name: - description: If specified, this - must be an IANA_SVC_NAME and unique - within the pod. Each named port - in a pod must have a unique name. - Name for the port that can be - referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. - Must be UDP, TCP, or SCTP. Defaults - to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of Sidecar - service readiness. Container will be - removed from service endpoints if the - probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Sidecar. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the - maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted - for a container, it defaults to - Limits if that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of - an executable file to execute. \n If - Script is not empty, the Step cannot - have an Command or Args." - type: string - securityContext: - description: 'SecurityContext defines - the security options the Sidecar should - be run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent - process. This bool directly controls - if the no_new_privs flag will be - set on the container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has - CAP_SYS_ADMIN Note that this field - cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. - Note that this field cannot be set - when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the - type of proc mount to use for the - containers. The default is DefaultProcMount - which uses the container runtime - defaults for readonly paths and - masked paths. This requires the - ProcMountType feature flag to be - enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. - Default is false. Note that this - field cannot be set when spec.os.name - is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If - true, the Kubelet will validate - the image at runtime to ensure that - it does not run as UID 0 (root) - and fail to start the container - if it does. If unset or false, no - such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If - unspecified, the container runtime - will allocate a random SELinux context - for each container. May also be - set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - properties: - level: - description: Level is SELinux - level label that applies to - the container. - type: string - role: - description: Role is a SELinux - role label that applies to the - container. - type: string - type: - description: Type is a SELinux - type label that applies to the - container. - type: string - user: - description: User is a SELinux - user label that applies to the - container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the - pod & container level, the container - options override the pod options. - Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile - indicates a profile defined - in a file on the node should - be used. The profile must be - preconfigured on the node to - work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must - only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will - be applied. Valid options are: - \n Localhost - a profile defined - in a file on the node should - be used. RuntimeDefault - the - container runtime default profile - should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific - settings applied to all containers. - If unspecified, the options from - the PodSecurityContext will be used. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission - webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the - GMSA credential spec named by - the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run - as a 'Host Process' container. - This field is alpha-level and - will only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective - HostProcess value (it is not - allowed to have a mix of HostProcess - containers and non-HostProcess - containers). In addition, if - HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the - container process. Defaults - to the user specified in image - metadata if unspecified. May - also be set in PodSecurityContext. - If set in both SecurityContext - and PodSecurityContext, the - value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that - the Pod the Sidecar is running in has - successfully initialized. If specified, - no other probes are executed until this - completes successfully. If this probe - fails, the Pod will be restarted, just - as if the livenessProbe failed. This - can be used to provide different probe - parameters at the beginning of a Pod''s - lifecycle, when it might take a long - time to load data or warm a cache, than - during steady-state operation. This - cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this Sidecar should - allocate a buffer for stdin in the container - runtime. If this is not set, reads from - stdin in the Sidecar will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Whether the container runtime - should close the stdin channel after - it has been opened by a single attach. - When stdin is true the stdin stream - will remain open across multiple attach - sessions. If stdinOnce is set to true, - stdin is opened on Sidecar start, is - empty until the first client attaches - to stdin, and then remains open and - accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the Sidecar is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which - the file to which the Sidecar''s termination - message will be written is mounted into - the Sidecar''s filesystem. Message written - is intended to be brief final status, - such as an assertion failure message. - Will be truncated by the node if greater - than 4096 bytes. The total message length - across all containers will be limited - to 12kb. Defaults to /dev/termination-log. - Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will - use the contents of terminationMessagePath - to populate the Sidecar status message - on both success and failure. FallbackToLogsOnError - will use the last chunk of Sidecar log - output if the termination message file - is empty and the Sidecar exited with - an error. The log output is limited - to 2048 bytes or 80 lines, whichever - is smaller. Defaults to File. Cannot - be updated. - type: string - tty: - description: Whether this Sidecar should - allocate a TTY for itself, also requires - 'stdin' to be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list - of block devices to be used by the Sidecar. - items: - description: volumeDevice describes - a mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the - name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the - Sidecar's filesystem. Cannot be updated. - items: - description: VolumeMount describes a - mounting of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be - mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from - the host to container and the - other way around. When not set, - MountPropagationNone is used. - This field is beta in 1.10. - type: string - name: - description: This must match the - Name of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath - are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Sidecar's working directory. - If not specified, the container runtime's - default will be used, which might be - configured in the container image. Cannot - be updated. - type: string - workspaces: - description: "This is an alpha field. - You must set the \"enable-api-fields\" - feature flag to \"alpha\" for this field - to be supported. \n Workspaces is a - list of workspaces from the Task that - this Sidecar wants exclusive access - to. Adding a workspace to this list - means that any other Step or Sidecar - that does not also request this Workspace - will not have access to it." - items: - description: WorkspaceUsage is used - by a Step or Sidecar to declare that - it wants isolated access to a Workspace - defined in a Task. - properties: - mountPath: - description: MountPath is the path - that the workspace should be mounted - to inside the Step or Sidecar, - overriding any MountPath specified - in the Task's WorkspaceDeclaration. - type: string - name: - description: Name is the name of - the workspace this Step or Sidecar - wants access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - spec: - description: Spec is a specification of a custom - task - type: object - stepTemplate: - description: StepTemplate can be used as the - basis for all step containers within the Task, - so that the steps inherit settings on the - base container. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the Step''s environment. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to a - single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The docker image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Step''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string - literal "$(VAR_NAME)". Escaped references - will never be expanded, regardless of - whether the variable exists or not. Cannot - be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using the - previously defined environment variables - in the container and any service - environment variables. If a variable - cannot be resolved, the reference - in the input string will be unchanged. - Double $$ are reduced to a single - $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal - "$(VAR_NAME)". Escaped references - will never be expanded, regardless - of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is - written in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the Step. The - keys defined within a source must be a - C_IDENTIFIER. All invalid keys will be - reported as an event when the container - is starting. When a key exists in multiple - sources, the value associated with the - last source will take precedence. Values - defined by an Env with a duplicate key - will take precedence. Cannot be updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Default image name to use - for each Step. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher - level config management to default or - override container images in workload - controllers like Deployments and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will - be removed in a future release. Actions - that the management system should take - in response to container lifecycle events. - Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute inside - the container, the working - directory for the command is - root ('/') in the container's - filesystem. The command is - simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, - you need to explicitly call - out to that shell. Exit status - of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes or - until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute inside - the container, the working - directory for the command is - root ('/') in the container's - filesystem. The command is - simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, - you need to explicitly call - out to that shell. Exit status - of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Container - will be restarted if the probe fails. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Deprecated. This field will - be removed in a future release. Default - name for each Step specified as a DNS_LABEL. - Each Step in a Task must have a unique - name. Cannot be updated. - type: string - ports: - description: Deprecated. This field will - be removed in a future release. List of - ports to expose from the Step's container. - Exposing a port here gives the system - additional information about the network - connections a container uses, but is primarily - informational. Not specifying a port here - DOES NOT prevent that port from being - exposed. Any port which is listening on - the default "0.0.0.0" address inside a - container will be accessible from the - network. Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < - 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 < - x < 65536. If HostNetwork is specified, - this must match ContainerPort. Most - containers do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to - by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. - Container will be removed from service - endpoints if the probe fails. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Step. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted for - a container, it defaults to Limits - if that is explicitly specified, otherwise - to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the - security options the Step should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the - no_new_privs flag will be set on the - container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has CAP_SYS_ADMIN - Note that this field cannot be set - when spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. Note - that this field cannot be set when - spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this - field cannot be set when spec.os.name - is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does - not run as UID 0 (root) and fail to - start the container if it does. If - unset or false, no such validation - will be performed. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each - container. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the pod - & container level, the container options - override the pod options. Note that - this field cannot be set when spec.os.name - is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on - the node should be used. The profile - must be preconfigured on the node - to work. Must be a descending - path, relative to the kubelet's - configured seccomp profile location. - Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n - Localhost - a profile defined - in a file on the node should be - used. RuntimeDefault - the container - runtime default profile should - be used. Unconfined - no profile - should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value - specified in SecurityContext takes - precedence. Note that this field cannot - be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will - only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective HostProcess - value (it is not allowed to have - a mix of HostProcess containers - and non-HostProcess containers). In - addition, if HostProcess is true - then HostNetwork must also be - set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user - specified in image metadata if - unspecified. May also be set in - PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod has successfully - initialized. If specified, no other probes - are executed until this completes successfully. - If this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe - parameters at the beginning of a Pod''s - lifecycle, when it might take a long time - to load data or warm a cache, than during - steady-state operation. This cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Deprecated. This field will - be removed in a future release. Whether - this Step should allocate a buffer for - stdin in the container runtime. If this - is not set, reads from stdin in the Step - will always result in EOF. Default is - false. - type: boolean - stdinOnce: - description: Deprecated. This field will - be removed in a future release. Whether - the container runtime should close the - stdin channel after it has been opened - by a single attach. When stdin is true - the stdin stream will remain open across - multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client - attaches to stdin, and then remains open - and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the container is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: Deprecated. This field will - be removed in a future release and cannot - be meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will - be removed in a future release and cannot - be meaningfully used. - type: string - tty: - description: Deprecated. This field will - be removed in a future release. Whether - this Step should allocate a DeprecatedTTY - for itself, also requires 'stdin' to be - true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Step. - items: - description: volumeDevice describes a - mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other - way around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath are - mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If - not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. - type: string - required: - - name - type: object - steps: - description: Steps are the steps of the build; - each step is run sequentially with the source - mounted into /workspace. - items: - description: Step runs a subcomponent of a - Task - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is - not provided. Variable references $(VAR_NAME) - are expanded using the container''s - environment. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded - using the container''s environment. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to - a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using - the previously defined environment - variables in the container and - any service environment variables. - If a variable cannot be resolved, - the reference in the input string - will be unchanged. Double $$ are - reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". - Escaped references will never - be expanded, regardless of whether - the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to - select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of - the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the container. - The keys defined within a source must - be a C_IDENTIFIER. All invalid keys - will be reported as an event when the - container is starting. When a key exists - in multiple sources, the value associated - with the last source will take precedence. - Values defined by an Env with a duplicate - key will take precedence. Cannot be - updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the - ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image reference name to - run for this Step. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will - be removed in a future release. Actions - that the management system should take - in response to container lifecycle events. - Cannot be updated. - properties: - postStart: - description: 'PostStart is called - immediately after a container is - created. If the handler fails, the - container is terminated and restarted - according to its restart policy. - Other management of the container - blocks until the hook completes. - More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated - due to an API request or management - event such as liveness/startup probe - failure, preemption, resource contention, - etc. The handler is not called if - the container crashes or exits. - The Pod''s termination grace period - countdown begins before the PreStop - hook is executed. Regardless of - the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes - or until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Step will - be restarted if the probe fails. Cannot - be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Step specified - as a DNS_LABEL. Each Step in a Task - must have a unique name. - type: string - onError: - description: OnError defines the exiting - behavior of a container on error can - be set to [ continue | stopAndFail ] - type: string - ports: - description: Deprecated. This field will - be removed in a future release. List - of ports to expose from the Step's container. - Exposing a port here gives the system - additional information about the network - connections a container uses, but is - primarily informational. Not specifying - a port here DOES NOT prevent that port - from being exposed. Any port which is - listening on the default "0.0.0.0" address - inside a container will be accessible - from the network. Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This - must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 - < x < 65536. If HostNetwork is - specified, this must match ContainerPort. - Most containers do not need this. - format: int32 - type: integer - name: - description: If specified, this - must be an IANA_SVC_NAME and unique - within the pod. Each named port - in a pod must have a unique name. - Name for the port that can be - referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. - Must be UDP, TCP, or SCTP. Defaults - to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. - Step will be removed from service endpoints - if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Step. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the - maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted - for a container, it defaults to - Limits if that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of - an executable file to execute. \n If - Script is not empty, the Step cannot - have an Command and the Args will be - passed to the Script." - type: string - securityContext: - description: 'SecurityContext defines - the security options the Step should - be run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent - process. This bool directly controls - if the no_new_privs flag will be - set on the container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has - CAP_SYS_ADMIN Note that this field - cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. - Note that this field cannot be set - when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the - type of proc mount to use for the - containers. The default is DefaultProcMount - which uses the container runtime - defaults for readonly paths and - masked paths. This requires the - ProcMountType feature flag to be - enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. - Default is false. Note that this - field cannot be set when spec.os.name - is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If - true, the Kubelet will validate - the image at runtime to ensure that - it does not run as UID 0 (root) - and fail to start the container - if it does. If unset or false, no - such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If - unspecified, the container runtime - will allocate a random SELinux context - for each container. May also be - set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - properties: - level: - description: Level is SELinux - level label that applies to - the container. - type: string - role: - description: Role is a SELinux - role label that applies to the - container. - type: string - type: - description: Type is a SELinux - type label that applies to the - container. - type: string - user: - description: User is a SELinux - user label that applies to the - container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the - pod & container level, the container - options override the pod options. - Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile - indicates a profile defined - in a file on the node should - be used. The profile must be - preconfigured on the node to - work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must - only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will - be applied. Valid options are: - \n Localhost - a profile defined - in a file on the node should - be used. RuntimeDefault - the - container runtime default profile - should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific - settings applied to all containers. - If unspecified, the options from - the PodSecurityContext will be used. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission - webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the - GMSA credential spec named by - the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run - as a 'Host Process' container. - This field is alpha-level and - will only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective - HostProcess value (it is not - allowed to have a mix of HostProcess - containers and non-HostProcess - containers). In addition, if - HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the - container process. Defaults - to the user specified in image - metadata if unspecified. May - also be set in PodSecurityContext. - If set in both SecurityContext - and PodSecurityContext, the - value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod this Step runs - in has successfully initialized. If - specified, no other probes are executed - until this completes successfully. If - this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. - This can be used to provide different - probe parameters at the beginning of - a Pod''s lifecycle, when it might take - a long time to load data or warm a cache, - than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stderrConfig: - description: Stores configuration for - the stderr stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - stdin: - description: Deprecated. This field will - be removed in a future release. Whether - this container should allocate a buffer - for stdin in the container runtime. - If this is not set, reads from stdin - in the container will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will - be removed in a future release. Whether - the container runtime should close the - stdin channel after it has been opened - by a single attach. When stdin is true - the stdin stream will remain open across - multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client - attaches to stdin, and then remains - open and accepts data until the client - disconnects, at which time stdin is - closed and remains closed until the - container is restarted. If this flag - is false, a container processes that - reads from stdin will never receive - an EOF. Default is false - type: boolean - stdoutConfig: - description: Stores configuration for - the stdout stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - terminationMessagePath: - description: Deprecated. This field will - be removed in a future release and can't - be meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will - be removed in a future release and can't - be meaningfully used. - type: string - timeout: - description: 'Timeout is the time after - which the step times out. Defaults to - never. Refer to Go''s ParseDuration - documentation for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - tty: - description: Deprecated. This field will - be removed in a future release. Whether - this container should allocate a DeprecatedTTY - for itself, also requires 'stdin' to - be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list - of block devices to be used by the Step. - items: - description: volumeDevice describes - a mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the - name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the - Step's filesystem. Cannot be updated. - items: - description: VolumeMount describes a - mounting of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be - mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from - the host to container and the - other way around. When not set, - MountPropagationNone is used. - This field is beta in 1.10. - type: string - name: - description: This must match the - Name of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath - are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. - If not specified, the container runtime's - default will be used, which might be - configured in the container image. Cannot - be updated. - type: string - workspaces: - description: "This is an alpha field. - You must set the \"enable-api-fields\" - feature flag to \"alpha\" for this field - to be supported. \n Workspaces is a - list of workspaces from the Task that - this Step wants exclusive access to. - Adding a workspace to this list means - that any other Step or Sidecar that - does not also request this Workspace - will not have access to it." - items: - description: WorkspaceUsage is used - by a Step or Sidecar to declare that - it wants isolated access to a Workspace - defined in a Task. - properties: - mountPath: - description: MountPath is the path - that the workspace should be mounted - to inside the Step or Sidecar, - overriding any MountPath specified - in the Task's WorkspaceDeclaration. - type: string - name: - description: Name is the name of - the workspace this Step or Sidecar - wants access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: Volumes is a collection of volumes - that are available to mount into the steps - of the build. - items: - description: Volume represents a named volume - in a pod that may be accessed by any container - in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached - to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can - leave the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true - will force the readOnly setting - in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID - of the persistent disk resource - in AWS (Amazon EBS volume). More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure - Data Disk mount on the host and bind - mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host - Caching mode: None, Read Only, Read - Write.' - type: string - diskName: - description: diskName is the Name - of the data disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of - data disk in the blob storage - type: string - fsType: - description: fsType is Filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - kind: - description: 'kind expected values - are Shared: multiple blob disks - per storage account Dedicated: - single blob disk per storage account Managed: - azure managed data disk (only in - managed availability set). defaults - to shared' - type: string - readOnly: - description: readOnly Defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure - File Service mount on the host and bind - mount to the pod. - properties: - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretName: - description: secretName is the name - of secret that contains Azure Storage - Account Name and Key - type: string - shareName: - description: shareName is the azure - share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph - FS mount on the host that shares a pod's - lifetime - properties: - monitors: - description: 'monitors is Required: - Monitors is a collection of Ceph - monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used - as the mounted root, rather than - the full Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: - Defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring - for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: - SecretRef is reference to the authentication - secret for User, default is empty. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - user: - description: 'user is optional: User - is the rados user name, default - is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder - volume attached and mounted on kubelets - host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: - points to a secret object containing - parameters used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: - https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions - on created files by default. Must - be an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Defaults - to 0644. Directories within the - path are not affected by this setting. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced ConfigMap - will be projected into the volume - as a file whose name is the key - and content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the ConfigMap, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be - defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is - handled by certain external CSI drivers - (Beta feature). - properties: - driver: - description: driver is the name of - the CSI driver that handles this - volume. Consult with your admin - for the correct name as registered - in the cluster. - type: string - fsType: - description: fsType to mount. Ex. - "ext4", "xfs", "ntfs". If not provided, - the empty value is passed to the - associated CSI driver which will - determine the default filesystem - to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef - is a reference to the secret object - containing sensitive information - to pass to the CSI driver to complete - the CSI NodePublishVolume and NodeUnpublishVolume - calls. This field is optional, and may - be empty if no secret is required. - If the secret object contains more - than one secret, all secret references - are passed. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a - read-only configuration for the - volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores - driver-specific properties that - are passed to the CSI driver. Consult - your driver's documentation for - supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward - API about the pod that should populate - this volume - properties: - defaultMode: - description: 'Optional: mode bits - to use on created files by default. - Must be a Optional: mode bits used - to set permissions on created files - by default. Must be an octal value - between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts - both octal and decimal values, JSON - requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected - by this setting. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward - API volume file - items: - description: DownwardAPIVolumeFile - represents information to create - the file containing the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode - bits used to set permissions - on this file, must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path - is the relative path name - of the file to be created. - Must not be absolute or contain - the ''..'' path. Must be utf-8 - encoded. The first item of - the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what - type of storage medium should back - this directory. The default is "" - which means to use the node''s default - medium. Must be an empty string - (default) or Memory. More info: - https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total - amount of local storage required - for this EmptyDir volume. The size - limit is also applicable for memory - medium. The maximum usage on memory - medium EmptyDir would be the minimum - value between the SizeLimit specified - here and the sum of memory limits - of all containers in a pod. The - default is nil which means that - the limit is undefined. More info: - http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage - driver. The volume's lifecycle is tied - to the pod that defines it - it will - be created before the pod starts, and - deleted when the pod is removed. \n - Use this if: a) the volume is only needed - while the pod runs, b) features of normal - volumes like restoring from snapshot - or capacity tracking are needed, - c) the storage driver is specified through - a storage class, and d) the storage - driver supports dynamic volume provisioning - through a PersistentVolumeClaim (see - EphemeralVolumeSource for more information - on the connection between this volume - type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one - of the vendor-specific APIs for volumes - that persist for longer than the lifecycle - of an individual pod. \n Use CSI for - light-weight local ephemeral volumes - if the CSI driver is meant to be used - that way - see the documentation of - the driver for more information. \n - A pod can use both types of ephemeral - volumes and persistent volumes at the - same time." - properties: - volumeClaimTemplate: - description: "Will be used to create - a stand-alone PVC to provision the - volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of - the PVC, i.e. the PVC will be deleted - together with the pod. The name - of the PVC will be `-` where `` is - the name from the `PodSpec.Volumes` - array entry. Pod validation will - reject the pod if the concatenated - name is not valid for a PVC (for - example, too long). \n An existing - PVC with that name that is not owned - by the pod will *not* be used for - the pod to avoid using an unrelated - volume by mistake. Starting the - pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod - exists. Normally this should not - be necessary, but it may be useful - when manually reconstructing a broken - cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels - and annotations that will be - copied into the PVC when creating - it. No other fields are allowed - and will be rejected during - validation. - type: object - spec: - description: The specification - for the PersistentVolumeClaim. - The entire content is copied - unchanged into the PVC that - gets created from this template. - The same fields as in a PersistentVolumeClaim - are also valid here. - properties: - accessModes: - description: 'accessModes - contains the desired access - modes the volume should - have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an - external controller can - support the specified data - source, it will create a - new volume based on the - contents of the specified - data source. If the AnyVolumeDataSource - feature gate is enabled, - this field will always have - the same contents as the - DataSourceRef field.' - properties: - apiGroup: - description: APIGroup - is the group for the - resource being referenced. - If APIGroup is not specified, - the specified Kind must - be in the core API group. - For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the - type of resource being - referenced - type: string - name: - description: Name is the - name of resource being - referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef - specifies the object from - which to populate the volume - with data, if a non-empty - volume is desired. This - may be any local object - from a non-empty API group - (non core object) or a PersistentVolumeClaim - object. When this field - is specified, volume binding - will only succeed if the - type of the specified object - matches some installed volume - populator or dynamic provisioner. - This field will replace - the functionality of the - DataSource field and as - such if both fields are - non-empty, they must have - the same value. For backwards - compatibility, both fields - (DataSource and DataSourceRef) - will be set to the same - value automatically if one - of them is empty and the - other is non-empty. There - are two important differences - between DataSource and DataSourceRef: - * While DataSource only - allows two specific types - of objects, DataSourceRef allows - any non-core object, as - well as PersistentVolumeClaim - objects. * While DataSource - ignores disallowed values - (dropping them), DataSourceRef preserves - all values, and generates - an error if a disallowed - value is specified. (Beta) - Using this field requires - the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup - is the group for the - resource being referenced. - If APIGroup is not specified, - the specified Kind must - be in the core API group. - For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the - type of resource being - referenced - type: string - name: - description: Name is the - name of resource being - referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the - volume should have. If RecoverVolumeExpansionFailure - feature is enabled users - are allowed to specify resource - requirements that are lower - than previous value but - must still be higher than - capacity recorded in the - status field of the claim. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of - compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests - describes the minimum - amount of compute resources - required. If Requests - is omitted for a container, - it defaults to Limits - if that is explicitly - specified, otherwise - to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a - label query over volumes - to consider for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label - selector requirement - is a selector that - contains values, a - key, and an operator - that relates the key - and values. - properties: - key: - description: key - is the label key - that the selector - applies to. - type: string - operator: - description: operator - represents a key's - relationship to - a set of values. - Valid operators - are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values - is an array of - string values. - If the operator - is In or NotIn, - the values array - must be non-empty. - If the operator - is Exists or DoesNotExist, - the values array - must be empty. - This array is - replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels - is a map of {key,value} - pairs. A single {key,value} - in the matchLabels map - is equivalent to an - element of matchExpressions, - whose key field is "key", - the operator is "In", - and the values array - contains only "value". - The requirements are - ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is - the binding reference to - the PersistentVolume backing - this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel - resource that is attached to a kubelet's - host machine and then exposed to the - pod. - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. TODO: how do we - prevent errors in the filesystem - from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC - target lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: - Defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: - FC target worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs - and lun must be set, but not both - simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. - properties: - driver: - description: driver is the name of - the driver to use for this volume. - type: string - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - The default filesystem depends on - FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: - this field holds extra command options - if any.' - type: object - readOnly: - description: 'readOnly is Optional: - defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: - secretRef is reference to the secret - object containing sensitive information - to pass to the plugin scripts. This - may be empty if no secret object - is specified. If the secret object - contains more than one secret, all - secrets are passed to the plugin - scripts.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker - volume attached to a kubelet's host - machine. This depends on the Flocker - control service being running - properties: - datasetName: - description: datasetName is Name of - the dataset stored as metadata -> - name on the dataset for Flocker - should be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID - of the dataset. This is unique identifier - of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached - to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can - leave the property empty). More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name - of the PD resource in GCE. Used - to identify the disk in GCE. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git - repository at a particular revision. - DEPRECATED: GitRepo is deprecated. To - provision a container with a git repo, - mount an EmptyDir into an InitContainer - that clones the repo using git, then - mount the EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target - directory name. Must not contain - or start with '..'. If '.' is supplied, - the volume directory will be the - git repository. Otherwise, if specified, - the volume will contain the git - repository in the subdirectory with - the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit - hash for the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs - volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted - with read-only permissions. Defaults - to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine - that is directly exposed to the container. - This is generally used for system agents - or other privileged things that are - allowed to see the host machine. Most - containers will NOT need this. More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict - who can use host directory mounts and - who can/can not mount host directories - as read/write.' - properties: - path: - description: 'path of the directory - on the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI - Disk resource that is attached to a - kubelet''s host machine and then exposed - to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines - whether support iSCSI Discovery - CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines - whether support iSCSI Session CHAP - authentication - type: boolean - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - initiatorName: - description: initiatorName is the - custom iSCSI Initiator Name. If - initiatorName is specified with - iscsiInterface simultaneously, new - iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI - Qualified Name. - type: string - iscsiInterface: - description: iscsiInterface is the - interface Name that uses an iSCSI - transport. Defaults to 'default' - (tcp). - type: string - lun: - description: lun represents iSCSI - Target Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI - Target Portal List. The portal is - either an IP or ip_addr:port if - the port is other than default (typically - TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP - Secret for iSCSI target and initiator - authentication - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI - Target Portal. The Portal is either - an IP or ip_addr:port if the port - is other than default (typically - TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must - be a DNS_LABEL and unique within the - pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported - by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force - the NFS export to be mounted with - read-only permissions. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname - or IP address of the NFS server. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name - of a PersistentVolumeClaim in the - same namespace as the pod using - this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the - ReadOnly setting in VolumeMounts. - Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents - a PhotonController persistent disk attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents - a portworx volume attached and mounted - on kubelets host machine - properties: - fsType: - description: fSType represents the - filesystem type to mount Must be - a filesystem type supported by the - host operating system. Ex. "ext4", - "xfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in - one resources secrets, configmaps, and - downward API - properties: - defaultMode: - description: defaultMode are the mode - bits used to set permissions on - created files by default. Must be - an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected - by this setting. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set. - format: int32 - type: integer - sources: - description: sources is the list of - volume projections - items: - description: Projection that may - be projected along with other - supported volume types - properties: - configMap: - description: configMap information - about the configMap data to - project - properties: - items: - description: items if unspecified, - each key-value pair in - the Data field of the - referenced ConfigMap will - be projected into the - volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be - projected into the specified - paths, and unlisted keys - will not be present. If - a key is specified which - is not present in the - ConfigMap, the volume - setup will error unless - it is marked optional. - Paths must be relative - and may not contain the - '..' path or start with - '..'. - items: - description: Maps a string - key to a path within - a volume. - properties: - key: - description: key is - the key to project. - type: string - mode: - description: 'mode - is Optional: mode - bits used to set - permissions on this - file. Must be an - octal value between - 0000 and 0777 or - a decimal value - between 0 and 511. - YAML accepts both - octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: path - is the relative - path of the file - to map the key to. - May not be an absolute - path. May not contain - the path element - '..'. May not start - with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional specify - whether the ConfigMap - or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data - to project - properties: - items: - description: Items is a - list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile - represents information - to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: - Selects a field - of the pod: only - annotations, labels, - name and namespace - are supported.' - properties: - apiVersion: - description: Version - of the schema - the FieldPath - is written in - terms of, defaults - to "v1". - type: string - fieldPath: - description: Path - of the field - to select in - the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: - mode bits used to - set permissions - on this file, must - be an octal value - between 0000 and - 0777 or a decimal - value between 0 - and 511. YAML accepts - both octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: - Path is the relative - path name of the - file to be created. - Must not be absolute - or contain the ''..'' - path. Must be utf-8 - encoded. The first - item of the relative - path must not start - with ''..''' - type: string - resourceFieldRef: - description: 'Selects - a resource of the - container: only - resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container - name: required - for volumes, - optional for - env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format - of the exposed - resources, defaults - to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to - select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information - about the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in - the Data field of the - referenced Secret will - be projected into the - volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be - projected into the specified - paths, and unlisted keys - will not be present. If - a key is specified which - is not present in the - Secret, the volume setup - will error unless it is - marked optional. Paths - must be relative and may - not contain the '..' path - or start with '..'. - items: - description: Maps a string - key to a path within - a volume. - properties: - key: - description: key is - the key to project. - type: string - mode: - description: 'mode - is Optional: mode - bits used to set - permissions on this - file. Must be an - octal value between - 0000 and 0777 or - a decimal value - between 0 and 511. - YAML accepts both - octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: path - is the relative - path of the file - to map the key to. - May not be an absolute - path. May not contain - the path element - '..'. May not start - with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional field - specify whether the Secret - or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken - is information about the serviceAccountToken - data to project - properties: - audience: - description: audience is - the intended audience - of the token. A recipient - of a token must identify - itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. - The audience defaults - to the identifier of the - apiserver. - type: string - expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the - token approaches expiration, - the kubelet volume plugin - will proactively rotate - the service account token. - The kubelet will start - trying to rotate the token - if the token is older - than 80 percent of its - time to live or if the - token is older than 24 - hours.Defaults to 1 hour - and must be at least 10 - minutes. - format: int64 - type: integer - path: - description: path is the - path relative to the mount - point of the file to project - the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte - mount on the host that shares a pod's - lifetime - properties: - group: - description: group to map volume access - to Default is no group - type: string - readOnly: - description: readOnly here will force - the Quobyte volume to be mounted - with read-only permissions. Defaults - to false. - type: boolean - registry: - description: registry represents a - single or multiple Quobyte Registry - services specified as a string as - host:port pair (multiple entries - are separated with commas) which - acts as the central registry for - volumes - type: string - tenant: - description: tenant owning the given - Quobyte volume in the Backend Used - with dynamically provisioned Quobyte - volumes, value is set by the plugin - type: string - user: - description: user to map volume access - to Defaults to serivceaccount user - type: string - volume: - description: volume is a string that - references an already created Quobyte - volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares - a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path - to key ring for RBDUser. Default - is /etc/ceph/keyring. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool - name. Default is rbd. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of - the authentication secret for RBDUser. - If provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - user: - description: 'user is the rados user - name. Default is admin. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO - persistent volume attached and mounted - on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Default is "xfs". - type: string - gateway: - description: gateway is the host address - of the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the - name of the ScaleIO Protection Domain - for the configured storage. - type: string - readOnly: - description: readOnly Defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef references - to the secret for ScaleIO user and - other sensitive information. If - this is not provided, Login operation - will fail. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, - default false - type: boolean - storageMode: - description: storageMode indicates - whether the storage for a volume - should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO - Storage Pool associated with the - protection domain. - type: string - system: - description: system is the name of - the storage system as configured - in ScaleIO. - type: string - volumeName: - description: volumeName is the name - of a volume already created in the - ScaleIO system that is associated - with this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret - that should populate this volume. More - info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions - on created files by default. Must - be an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Defaults - to 0644. Directories within the - path are not affected by this setting. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, - each key-value pair in the Data - field of the referenced Secret will - be projected into the volume as - a file whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the Secret, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify - whether the Secret or its keys must - be defined - type: boolean - secretName: - description: 'secretName is the name - of the secret in the pod''s namespace - to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes - nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the - secret to use for obtaining the - StorageOS API credentials. If not - specified, default values will be - attempted. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume - names are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the - Pod's namespace will be used. This - allows the Kubernetes name scoping - to be mirrored within StorageOS - for tighter integration. Set VolumeName - to any name to override the default - behaviour. Set to "default" if you - are not using namespaces within - StorageOS. Namespaces that do not - pre-exist within StorageOS will - be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents - a vSphere volume attached and mounted - on kubelets host machine - properties: - fsType: - description: fsType is filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the - storage Policy Based Management - (SPBM) profile ID associated with - the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is - the storage Policy Based Management - (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path - that identifies vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces are the volumes that - this Task requires. - items: - description: WorkspaceDeclaration is a declaration - of a volume that a Task requires. - properties: - description: - description: Description is an optional - human readable description of this volume. - type: string - mountPath: - description: MountPath overrides the directory - that the volume will be made available - at. - type: string - name: - description: Name is the name by which - you can bind the volume at runtime. - type: string - optional: - description: Optional marks a Workspace - as not being required in TaskRuns. By - default this field is false and so declared - workspaces are required. - type: boolean - readOnly: - description: ReadOnly dictates whether - a mounted volume is writable. By default - this field is false and so mounted volumes - are writable. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - timeout: - description: 'Time after which the TaskRun times - out. Defaults to 1 hour. Specified TaskRun timeout - should be less than 24h. Refer Go''s ParseDuration - documentation for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - when: - description: WhenExpressions is a list of when expressions - that need to be true for the task to run - items: - description: WhenExpression allows a PipelineTask - to declare expressions to be evaluated before - the Task is run to determine whether the Task - should be executed or skipped - properties: - input: - description: Input is the string for guard - checking which can be a static input or - an output from a parent Task - type: string - operator: - description: Operator that represents an Input's - relationship to the values - type: string - values: - description: Values is an array of strings, - which is compared against the input, for - guard checking It must be non-empty - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - input - - operator - - values - type: object - type: array - workspaces: - description: Workspaces maps workspaces from the - pipeline spec to the workspaces declared in the - Task. - items: - description: WorkspacePipelineTaskBinding describes - how a workspace passed into the pipeline should - be mapped to a task's declared workspace. - properties: - name: - description: Name is the name of the workspace - as declared by the task - type: string - subPath: - description: SubPath is optionally a directory - on the volume which should be used for this - binding (i.e. the volume will be mounted - at this sub directory). - type: string - workspace: - description: Workspace is the name of the - workspace declared by the pipeline - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - params: - description: Params declares a list of input parameters - that must be supplied when this Pipeline is run. - items: - description: ParamSpec defines arbitrary parameters - needed beyond typed inputs (such as resources). Parameter - values are provided by users as inputs on a TaskRun - or PipelineRun. - properties: - default: - description: Default is the value a parameter takes - if no input value is supplied. If default is set, - a Task may be executed without a supplied value - for the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of - an input parameter; Used to distinguish between - a single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing description - of the parameter that may be used to populate - a UI. - type: string - name: - description: Name declares the name by which a parameter - is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the struct for - object keys - properties: - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array of - strings. - type: string - type: object - description: Properties is the JSON Schema properties - to support key-value pairs parameter. - type: object - type: - description: Type is the user-specified type of - the parameter. The possible types are currently - "string", "array" and "object", and "string" is - the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the names and types of - the resources given to the Pipeline's tasks as inputs - and outputs. - items: - description: PipelineDeclaredResource is used by a Pipeline - to declare the types of the PipelineResources that - it will required to run and names which can be used - to refer to these PipelineResources in PipelineTaskResourceBindings. - properties: - name: - description: Name is the name that will be used - by the Pipeline to refer to this resource. It - does not directly correspond to the name of any - PipelineResources Task inputs or outputs, and - it does not correspond to the actual names of - the PipelineResources that will be bound in the - PipelineRun. - type: string - optional: - description: 'Optional declares the resource as - optional. optional: true - the resource is considered - optional optional: false - the resource is considered - required (default/equivalent of not specifying - it)' - type: boolean - type: - description: Type is the type of the PipelineResource. - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - results: - description: Results are values that this pipeline can - output once run - items: - description: PipelineResult used to describe the results - of a pipeline - properties: - description: - description: Description is a human-readable description - of the result - type: string - name: - description: Name the given name - type: string - type: - description: Type is the user-specified type of - the result. The possible types are 'string', 'array', - and 'object', with 'string' as the default. 'array' - and 'object' types are alpha features. - type: string - value: - description: Value the expression used to retrieve - the value - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type of - an input parameter; Used to distinguish between - a single string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - tasks: - description: Tasks declares the graph of Tasks that execute - when this Pipeline is run. - items: - description: PipelineTask defines a task in a Pipeline, - passing inputs from both Params and from the output - of previous tasks. - properties: - matrix: - description: Matrix declares parameters used to - fan out this task. - properties: - params: - description: Params is a list of parameters - used to fan out the pipelineTask Params takes - only `Parameters` of type `"array"` Each array - element is supplied to the `PipelineTask` - by substituting `params` of type `"string"` - in the underlying `Task`. The names of the - `params` in the `Matrix` must match the names - of the `params` in the underlying `Task` that - they will be substituting. - items: - description: Param declares an ParamValues - to use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that - can hold a single string or string array. - Used in JSON unmarshalling so that a - single JSON field can accept either - an individual string or an array of - strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - name: - description: Name is the name of this task within - the context of a Pipeline. Name is used as a coordinate - with the `from` and `runAfter` fields to establish - the execution order of tasks relative to one another. - type: string - params: - description: Parameters declares parameters passed - to this task. - items: - description: Param declares an ParamValues to - use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that can - hold a single string or string array. Used - in JSON unmarshalling so that a single JSON - field can accept either an individual string - or an array of strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the type - of an input parameter; Used to distinguish - between a single string and an array - of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources declares the resources given - to this task as inputs and outputs. - properties: - inputs: - description: Inputs holds the mapping from the - PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: PipelineTaskInputResource maps - the name of a declared PipelineResource - input dependency in a Task to the resource - in the Pipeline's DeclaredPipelineResources - that should be used. This input may come - from a previous task. - properties: - from: - description: From is the list of PipelineTask - names that the resource has to come - from. (Implies an ordering in the execution - graph.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the - DeclaredPipelineResource to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required by - the Task. - items: - description: PipelineTaskOutputResource maps - the name of a declared PipelineResource - output dependency in a Task to the resource - in the Pipeline's DeclaredPipelineResources - that should be used. - properties: - name: - description: Name is the name of the PipelineResource - as declared by the Task. - type: string - resource: - description: Resource is the name of the - DeclaredPipelineResource to use. - type: string - required: - - name - - resource - type: object - type: array - x-kubernetes-list-type: atomic - type: object - retries: - description: 'Retries represents how many times - this task should be retried in case of task failure: - ConditionSucceeded set to False' - type: integer - runAfter: - description: RunAfter is the list of PipelineTask - names that should be executed before this Task - executes. (Used to force a specific ordering in - graph execution.) - items: - type: string - type: array - x-kubernetes-list-type: atomic - taskRef: - description: TaskRef is a reference to a task definition. - properties: - apiVersion: - description: API version of the referent - type: string - bundle: - description: 'Bundle url reference to a Tekton - Bundle. Deprecated: Please use ResolverRef - with the bundles resolver instead.' - type: string - kind: - description: TaskKind indicates the kind of - the task, namespaced or cluster scoped. - type: string - name: - description: 'Name of the referent; More info: - http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - params: - description: Params contains the parameters - used to identify the referenced Tekton resource. - Example entries might include "repo" or "path" - but the set of params ultimately depends on - the chosen resolver. - items: - description: Param declares an ParamValues - to use for the parameter called name. - properties: - name: - type: string - value: - description: ParamValue is a type that - can hold a single string or string array. - Used in JSON unmarshalling so that a - single JSON field can accept either - an individual string or an array of - strings. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - resolver: - description: Resolver is the name of the resolver - that should perform resolution of the referenced - Tekton resource, such as "git". - type: string - type: object - taskSpec: - description: TaskSpec is a specification of a task - properties: - apiVersion: - type: string - description: - description: Description is a user-facing description - of the task that may be used to populate a - UI. - type: string - kind: - type: string - metadata: - description: PipelineTaskMetadata contains the - labels or annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - params: - description: Params is a list of input parameters - required to run the task. Params must be supplied - as inputs in TaskRuns unless they declare - a default value. - items: - description: ParamSpec defines arbitrary parameters - needed beyond typed inputs (such as resources). - Parameter values are provided by users as - inputs on a TaskRun or PipelineRun. - properties: - default: - description: Default is the value a parameter - takes if no input value is supplied. - If default is set, a Task may be executed - without a supplied value for the parameter. - properties: - arrayVal: - items: - type: string - type: array - x-kubernetes-list-type: atomic - objectVal: - additionalProperties: - type: string - type: object - stringVal: - type: string - type: - description: ParamType indicates the - type of an input parameter; Used - to distinguish between a single - string and an array of strings. - type: string - required: - - arrayVal - - objectVal - - stringVal - - type - type: object - description: - description: Description is a user-facing - description of the parameter that may - be used to populate a UI. - type: string - name: - description: Name declares the name by - which a parameter is referenced. - type: string - properties: - additionalProperties: - description: PropertySpec defines the - struct for object keys - properties: - type: - description: ParamType indicates - the type of an input parameter; - Used to distinguish between a - single string and an array of - strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs - parameter. - type: object - type: - description: Type is the user-specified - type of the parameter. The possible - types are currently "string", "array" - and "object", and "string" is the default. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - resources: - description: Resources is a list input and output - resource to run the task Resources are represented - in TaskRuns as bindings to instances of PipelineResources. - properties: - inputs: - description: Inputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required - by the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used - to refer to these Resources within the - Task definition, and when provided as - an Input, the Name will be the path - to the volume mounted containing this - Resource as an input (e.g. an input - Resource named `workspace` will be mounted - at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name - by which a resource is referenced - in the definition. Resources may - be referenced by name in the definition - of a Task's steps. - type: string - optional: - description: 'Optional declares the - resource as optional. By default - optional is set to false which makes - a resource required. optional: true - - the resource is considered optional - optional: false - the resource is - considered required (equivalent - of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path - in workspace directory where the - resource will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - outputs: - description: Outputs holds the mapping from - the PipelineResources declared in DeclaredPipelineResources - to the input PipelineResources required - by the Task. - items: - description: TaskResource defines an input - or output Resource declared as a requirement - by a Task. The Name field will be used - to refer to these Resources within the - Task definition, and when provided as - an Input, the Name will be the path - to the volume mounted containing this - Resource as an input (e.g. an input - Resource named `workspace` will be mounted - at `/workspace`). - properties: - description: - description: Description is a user-facing - description of the declared resource - that may be used to populate a UI. - type: string - name: - description: Name declares the name - by which a resource is referenced - in the definition. Resources may - be referenced by name in the definition - of a Task's steps. - type: string - optional: - description: 'Optional declares the - resource as optional. By default - optional is set to false which makes - a resource required. optional: true - - the resource is considered optional - optional: false - the resource is - considered required (equivalent - of not specifying it)' - type: boolean - targetPath: - description: TargetPath is the path - in workspace directory where the - resource will be copied. - type: string - type: - description: Type is the type of this - resource; - type: string - required: - - name - - type - type: object - type: array - x-kubernetes-list-type: atomic - type: object - results: - description: Results are values that this Task - can output - items: - description: TaskResult used to describe the - results of a task - properties: - description: - description: Description is a human-readable - description of the result - type: string - name: - description: Name the given name - type: string - properties: - additionalProperties: - description: PropertySpec defines the - struct for object keys - properties: - type: - description: ParamType indicates - the type of an input parameter; - Used to distinguish between a - single string and an array of - strings. - type: string - type: object - description: Properties is the JSON Schema - properties to support key-value pairs - results. - type: object - type: - description: Type is the user-specified - type of the result. The possible type - is currently "string" and will support - "array" in following work. - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - sidecars: - description: Sidecars are run alongside the - Task's step containers. They begin before - the steps start and end after the steps complete. - items: - description: Sidecar has nearly the same data - structure as Step but does not have the - ability to timeout. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is - not provided. Variable references $(VAR_NAME) - are expanded using the container''s - environment. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded - using the Sidecar''s environment. If - a variable cannot be resolved, the reference - in the input string will be unchanged. - Double $$ are reduced to a single $, - which allows for escaping the $(VAR_NAME) - syntax: i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the Sidecar. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using - the previously defined environment - variables in the container and - any service environment variables. - If a variable cannot be resolved, - the reference in the input string - will be unchanged. Double $$ are - reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". - Escaped references will never - be expanded, regardless of whether - the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to - select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of - the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the Sidecar. - The keys defined within a source must - be a C_IDENTIFIER. All invalid keys - will be reported as an event when the - Sidecar is starting. When a key exists - in multiple sources, the value associated - with the last source will take precedence. - Values defined by an Env with a duplicate - key will take precedence. Cannot be - updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the - ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image name to be used by - the Sidecar. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Actions that the management - system should take in response to Sidecar - lifecycle events. Cannot be updated. - properties: - postStart: - description: 'PostStart is called - immediately after a container is - created. If the handler fails, the - container is terminated and restarted - according to its restart policy. - Other management of the container - blocks until the hook completes. - More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated - due to an API request or management - event such as liveness/startup probe - failure, preemption, resource contention, - etc. The handler is not called if - the container crashes or exits. - The Pod''s termination grace period - countdown begins before the PreStop - hook is executed. Regardless of - the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes - or until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Periodic probe of Sidecar - liveness. Container will be restarted - if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Sidecar specified - as a DNS_LABEL. Each Sidecar in a Task - must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: List of ports to expose from - the Sidecar. Exposing a port here gives - the system additional information about - the network connections a container - uses, but is primarily informational. - Not specifying a port here DOES NOT - prevent that port from being exposed. - Any port which is listening on the default - "0.0.0.0" address inside a container - will be accessible from the network. - Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This - must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 - < x < 65536. If HostNetwork is - specified, this must match ContainerPort. - Most containers do not need this. - format: int32 - type: integer - name: - description: If specified, this - must be an IANA_SVC_NAME and unique - within the pod. Each named port - in a pod must have a unique name. - Name for the port that can be - referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. - Must be UDP, TCP, or SCTP. Defaults - to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Periodic probe of Sidecar - service readiness. Container will be - removed from service endpoints if the - probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Sidecar. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the - maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted - for a container, it defaults to - Limits if that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of - an executable file to execute. \n If - Script is not empty, the Step cannot - have an Command or Args." - type: string - securityContext: - description: 'SecurityContext defines - the security options the Sidecar should - be run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent - process. This bool directly controls - if the no_new_privs flag will be - set on the container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has - CAP_SYS_ADMIN Note that this field - cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. - Note that this field cannot be set - when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the - type of proc mount to use for the - containers. The default is DefaultProcMount - which uses the container runtime - defaults for readonly paths and - masked paths. This requires the - ProcMountType feature flag to be - enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. - Default is false. Note that this - field cannot be set when spec.os.name - is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If - true, the Kubelet will validate - the image at runtime to ensure that - it does not run as UID 0 (root) - and fail to start the container - if it does. If unset or false, no - such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If - unspecified, the container runtime - will allocate a random SELinux context - for each container. May also be - set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - properties: - level: - description: Level is SELinux - level label that applies to - the container. - type: string - role: - description: Role is a SELinux - role label that applies to the - container. - type: string - type: - description: Type is a SELinux - type label that applies to the - container. - type: string - user: - description: User is a SELinux - user label that applies to the - container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the - pod & container level, the container - options override the pod options. - Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile - indicates a profile defined - in a file on the node should - be used. The profile must be - preconfigured on the node to - work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must - only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will - be applied. Valid options are: - \n Localhost - a profile defined - in a file on the node should - be used. RuntimeDefault - the - container runtime default profile - should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific - settings applied to all containers. - If unspecified, the options from - the PodSecurityContext will be used. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission - webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the - GMSA credential spec named by - the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run - as a 'Host Process' container. - This field is alpha-level and - will only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective - HostProcess value (it is not - allowed to have a mix of HostProcess - containers and non-HostProcess - containers). In addition, if - HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the - container process. Defaults - to the user specified in image - metadata if unspecified. May - also be set in PodSecurityContext. - If set in both SecurityContext - and PodSecurityContext, the - value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'StartupProbe indicates that - the Pod the Sidecar is running in has - successfully initialized. If specified, - no other probes are executed until this - completes successfully. If this probe - fails, the Pod will be restarted, just - as if the livenessProbe failed. This - can be used to provide different probe - parameters at the beginning of a Pod''s - lifecycle, when it might take a long - time to load data or warm a cache, than - during steady-state operation. This - cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Whether this Sidecar should - allocate a buffer for stdin in the container - runtime. If this is not set, reads from - stdin in the Sidecar will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Whether the container runtime - should close the stdin channel after - it has been opened by a single attach. - When stdin is true the stdin stream - will remain open across multiple attach - sessions. If stdinOnce is set to true, - stdin is opened on Sidecar start, is - empty until the first client attaches - to stdin, and then remains open and - accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the Sidecar is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: 'Optional: Path at which - the file to which the Sidecar''s termination - message will be written is mounted into - the Sidecar''s filesystem. Message written - is intended to be brief final status, - such as an assertion failure message. - Will be truncated by the node if greater - than 4096 bytes. The total message length - across all containers will be limited - to 12kb. Defaults to /dev/termination-log. - Cannot be updated.' - type: string - terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will - use the contents of terminationMessagePath - to populate the Sidecar status message - on both success and failure. FallbackToLogsOnError - will use the last chunk of Sidecar log - output if the termination message file - is empty and the Sidecar exited with - an error. The log output is limited - to 2048 bytes or 80 lines, whichever - is smaller. Defaults to File. Cannot - be updated. - type: string - tty: - description: Whether this Sidecar should - allocate a TTY for itself, also requires - 'stdin' to be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list - of block devices to be used by the Sidecar. - items: - description: volumeDevice describes - a mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the - name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the - Sidecar's filesystem. Cannot be updated. - items: - description: VolumeMount describes a - mounting of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be - mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from - the host to container and the - other way around. When not set, - MountPropagationNone is used. - This field is beta in 1.10. - type: string - name: - description: This must match the - Name of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath - are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Sidecar's working directory. - If not specified, the container runtime's - default will be used, which might be - configured in the container image. Cannot - be updated. - type: string - workspaces: - description: "This is an alpha field. - You must set the \"enable-api-fields\" - feature flag to \"alpha\" for this field - to be supported. \n Workspaces is a - list of workspaces from the Task that - this Sidecar wants exclusive access - to. Adding a workspace to this list - means that any other Step or Sidecar - that does not also request this Workspace - will not have access to it." - items: - description: WorkspaceUsage is used - by a Step or Sidecar to declare that - it wants isolated access to a Workspace - defined in a Task. - properties: - mountPath: - description: MountPath is the path - that the workspace should be mounted - to inside the Step or Sidecar, - overriding any MountPath specified - in the Task's WorkspaceDeclaration. - type: string - name: - description: Name is the name of - the workspace this Step or Sidecar - wants access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - spec: - description: Spec is a specification of a custom - task - type: object - stepTemplate: - description: StepTemplate can be used as the - basis for all step containers within the Task, - so that the steps inherit settings on the - base container. - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the Step''s environment. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to a - single $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The docker image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the Step''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string - literal "$(VAR_NAME)". Escaped references - will never be expanded, regardless of - whether the variable exists or not. Cannot - be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using the - previously defined environment variables - in the container and any service - environment variables. If a variable - cannot be resolved, the reference - in the input string will be unchanged. - Double $$ are reduced to a single - $, which allows for escaping the - $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal - "$(VAR_NAME)". Escaped references - will never be expanded, regardless - of whether the variable exists or - not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is - written in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of the - secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret or its key must - be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the Step. The - keys defined within a source must be a - C_IDENTIFIER. All invalid keys will be - reported as an event when the container - is starting. When a key exists in multiple - sources, the value associated with the - last source will take precedence. Values - defined by an Env with a duplicate key - will take precedence. Cannot be updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the ConfigMap. - Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether the - Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Default image name to use - for each Step. More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher - level config management to default or - override container images in workload - controllers like Deployments and StatefulSets.' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will - be removed in a future release. Actions - that the management system should take - in response to container lifecycle events. - Cannot be updated. - properties: - postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute inside - the container, the working - directory for the command is - root ('/') in the container's - filesystem. The command is - simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, - you need to explicitly call - out to that shell. Exit status - of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes or - until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute inside - the container, the working - directory for the command is - root ('/') in the container's - filesystem. The command is - simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, - you need to explicitly call - out to that shell. Exit status - of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on the - container. Number must be - in the range 1 to 65535. Name - must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Container - will be restarted if the probe fails. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Deprecated. This field will - be removed in a future release. Default - name for each Step specified as a DNS_LABEL. - Each Step in a Task must have a unique - name. Cannot be updated. - type: string - ports: - description: Deprecated. This field will - be removed in a future release. List of - ports to expose from the Step's container. - Exposing a port here gives the system - additional information about the network - connections a container uses, but is primarily - informational. Not specifying a port here - DOES NOT prevent that port from being - exposed. Any port which is listening on - the default "0.0.0.0" address inside a - container will be accessible from the - network. Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < - 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 < - x < 65536. If HostNetwork is specified, - this must match ContainerPort. Most - containers do not need this. - format: int32 - type: integer - name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to - by services. - type: string - protocol: - default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. - Container will be removed from service - endpoints if the probe fails. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Step. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted for - a container, it defaults to Limits - if that is explicitly specified, otherwise - to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - securityContext: - description: 'SecurityContext defines the - security options the Step should be run - with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the - no_new_privs flag will be set on the - container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has CAP_SYS_ADMIN - Note that this field cannot be set - when spec.os.name is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. Note - that this field cannot be set when - spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this - field cannot be set when spec.os.name - is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does - not run as UID 0 (root) and fail to - start the container if it does. If - unset or false, no such validation - will be performed. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each - container. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is - windows. - properties: - level: - description: Level is SELinux level - label that applies to the container. - type: string - role: - description: Role is a SELinux role - label that applies to the container. - type: string - type: - description: Type is a SELinux type - label that applies to the container. - type: string - user: - description: User is a SELinux user - label that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the pod - & container level, the container options - override the pod options. Note that - this field cannot be set when spec.os.name - is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on - the node should be used. The profile - must be preconfigured on the node - to work. Must be a descending - path, relative to the kubelet's - configured seccomp profile location. - Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n - Localhost - a profile defined - in a file on the node should be - used. RuntimeDefault - the container - runtime default profile should - be used. Unconfined - no profile - should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value - specified in SecurityContext takes - precedence. Note that this field cannot - be set when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. This - field is alpha-level and will - only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective HostProcess - value (it is not allowed to have - a mix of HostProcess containers - and non-HostProcess containers). In - addition, if HostProcess is true - then HostNetwork must also be - set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user - specified in image metadata if - unspecified. May also be set in - PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod has successfully - initialized. If specified, no other probes - are executed until this completes successfully. - If this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe - parameters at the beginning of a Pod''s - lifecycle, when it might take a long time - to load data or warm a cache, than during - steady-state operation. This cannot be - updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The command - is simply exec'd, it is not run - inside a shell, so traditional - shell instructions ('|', etc) - won't work. To use a shell, you - need to explicitly call out to - that shell. Exit status of 0 is - treated as live/healthy and non-zero - is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a beta - field and requires enabling GRPCContainerProbe - feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be in - the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by - gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the http - request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in - httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set - in the request. HTTP allows repeated - headers. - items: - description: HTTPHeader describes - a custom header to be used in - HTTP probes - properties: - name: - description: The header field - name - type: string - value: - description: The header field - value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on the - HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to 10 - seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 - to 65535. Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time - when the processes are forcibly halted - with a kill signal. Set this value - longer than the expected cleanup time - for your process. If this value is - nil, the pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by the - pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stdin: - description: Deprecated. This field will - be removed in a future release. Whether - this Step should allocate a buffer for - stdin in the container runtime. If this - is not set, reads from stdin in the Step - will always result in EOF. Default is - false. - type: boolean - stdinOnce: - description: Deprecated. This field will - be removed in a future release. Whether - the container runtime should close the - stdin channel after it has been opened - by a single attach. When stdin is true - the stdin stream will remain open across - multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client - attaches to stdin, and then remains open - and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the container is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false - type: boolean - terminationMessagePath: - description: Deprecated. This field will - be removed in a future release and cannot - be meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will - be removed in a future release and cannot - be meaningfully used. - type: string - tty: - description: Deprecated. This field will - be removed in a future release. Whether - this Step should allocate a DeprecatedTTY - for itself, also requires 'stdin' to be - true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list of - block devices to be used by the Step. - items: - description: volumeDevice describes a - mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the name - of a persistentVolumeClaim in the - pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the Step's - filesystem. Cannot be updated. - items: - description: VolumeMount describes a mounting - of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other - way around. When not set, MountPropagationNone - is used. This field is beta in 1.10. - type: string - name: - description: This must match the Name - of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath are - mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. If - not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. - type: string - required: - - name - type: object - steps: - description: Steps are the steps of the build; - each step is run sequentially with the source - mounted into /workspace. - items: - description: Step runs a subcomponent of a - Task - properties: - args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is - not provided. Variable references $(VAR_NAME) - are expanded using the container''s - environment. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, regardless - of whether the variable exists or not. - Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded - using the container''s environment. - If a variable cannot be resolved, the - reference in the input string will be - unchanged. Double $$ are reduced to - a single $, which allows for escaping - the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, - regardless of whether the variable exists - or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' - items: - type: string - type: array - x-kubernetes-list-type: atomic - env: - description: List of environment variables - to set in the container. Cannot be updated. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment - variable. Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references - $(VAR_NAME) are expanded using - the previously defined environment - variables in the container and - any service environment variables. - If a variable cannot be resolved, - the reference in the input string - will be unchanged. Double $$ are - reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce - the string literal "$(VAR_NAME)". - Escaped references will never - be expanded, regardless of whether - the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment - variable's value. Cannot be used - if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of - a ConfigMap. - properties: - key: - description: The key to - select. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the ConfigMap or its key - must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field - of the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of - a secret in the pod's namespace - properties: - key: - description: The key of - the secret to select from. Must - be a valid secret key. - type: string - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: Specify whether - the Secret or its key - must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - envFrom: - description: List of sources to populate - environment variables in the container. - The keys defined within a source must - be a C_IDENTIFIER. All invalid keys - will be reported as an event when the - container is starting. When a key exists - in multiple sources, the value associated - with the last source will take precedence. - Values defined by an Env with a duplicate - key will take precedence. Cannot be - updated. - items: - description: EnvFromSource represents - the source of a set of ConfigMaps - properties: - configMapRef: - description: The ConfigMap to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the ConfigMap must be defined - type: boolean - type: object - prefix: - description: An optional identifier - to prepend to each key in the - ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select - from - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: Specify whether - the Secret must be defined - type: boolean - type: object - type: object - type: array - x-kubernetes-list-type: atomic - image: - description: 'Image reference name to - run for this Step. More info: https://kubernetes.io/docs/concepts/containers/images' - type: string - imagePullPolicy: - description: 'Image pull policy. One of - Always, Never, IfNotPresent. Defaults - to Always if :latest tag is specified, - or IfNotPresent otherwise. Cannot be - updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' - type: string - lifecycle: - description: Deprecated. This field will - be removed in a future release. Actions - that the management system should take - in response to container lifecycle events. - Cannot be updated. - properties: - postStart: - description: 'PostStart is called - immediately after a container is - created. If the handler fails, the - container is terminated and restarted - according to its restart policy. - Other management of the container - blocks until the hook completes. - More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - preStop: - description: 'PreStop is called immediately - before a container is terminated - due to an API request or management - event such as liveness/startup probe - failure, preemption, resource contention, - etc. The handler is not called if - the container crashes or exits. - The Pod''s termination grace period - countdown begins before the PreStop - hook is executed. Regardless of - the outcome of the handler, the - container will eventually terminate - within the Pod''s termination grace - period (unless delayed by finalizers). - Other management of the container - blocks until the hook completes - or until the termination grace period - is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' - properties: - exec: - description: Exec specifies the - action to take. - properties: - command: - description: Command is the - command line to execute - inside the container, the - working directory for the - command is root ('/') in - the container's filesystem. - The command is simply exec'd, - it is not run inside a shell, - so traditional shell instructions - ('|', etc) won't work. To - use a shell, you need to - explicitly call out to that - shell. Exit status of 0 - is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - httpGet: - description: HTTPGet specifies - the http request to perform. - properties: - host: - description: Host name to - connect to, defaults to - the pod IP. You probably - want to set "Host" in httpHeaders - instead. - type: string - httpHeaders: - description: Custom headers - to set in the request. HTTP - allows repeated headers. - items: - description: HTTPHeader - describes a custom header - to be used in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access - on the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use - for connecting to the host. - Defaults to HTTP. - type: string - required: - - port - type: object - tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will - fail in runtime when tcp handler - is specified. - properties: - host: - description: 'Optional: Host - name to connect to, defaults - to the pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name - of the port to access on - the container. Number must - be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - type: object - type: object - livenessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container liveness. Step will - be restarted if the probe fails. Cannot - be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - name: - description: Name of the Step specified - as a DNS_LABEL. Each Step in a Task - must have a unique name. - type: string - onError: - description: OnError defines the exiting - behavior of a container on error can - be set to [ continue | stopAndFail ] - type: string - ports: - description: Deprecated. This field will - be removed in a future release. List - of ports to expose from the Step's container. - Exposing a port here gives the system - additional information about the network - connections a container uses, but is - primarily informational. Not specifying - a port here DOES NOT prevent that port - from being exposed. Any port which is - listening on the default "0.0.0.0" address - inside a container will be accessible - from the network. Cannot be updated. - items: - description: ContainerPort represents - a network port in a single container. - properties: - containerPort: - description: Number of port to expose - on the pod's IP address. This - must be a valid port number, 0 - < x < 65536. - format: int32 - type: integer - hostIP: - description: What host IP to bind - the external port to. - type: string - hostPort: - description: Number of port to expose - on the host. If specified, this - must be a valid port number, 0 - < x < 65536. If HostNetwork is - specified, this must match ContainerPort. - Most containers do not need this. - format: int32 - type: integer - name: - description: If specified, this - must be an IANA_SVC_NAME and unique - within the pod. Each named port - in a pod must have a unique name. - Name for the port that can be - referred to by services. - type: string - protocol: - default: TCP - description: Protocol for port. - Must be UDP, TCP, or SCTP. Defaults - to "TCP". - type: string - required: - - containerPort - type: object - type: array - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: 'Deprecated. This field will - be removed in a future release. Periodic - probe of container service readiness. - Step will be removed from service endpoints - if the probe fails. Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - resources: - description: 'Compute Resources required - by this Step. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the - maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the - minimum amount of compute resources - required. If Requests is omitted - for a container, it defaults to - Limits if that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - script: - description: "Script is the contents of - an executable file to execute. \n If - Script is not empty, the Step cannot - have an Command and the Args will be - passed to the Script." - type: string - securityContext: - description: 'SecurityContext defines - the security options the Step should - be run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' - properties: - allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent - process. This bool directly controls - if the no_new_privs flag will be - set on the container process. AllowPrivilegeEscalation - is true always when the container - is: 1) run as Privileged 2) has - CAP_SYS_ADMIN Note that this field - cannot be set when spec.os.name - is windows.' - type: boolean - capabilities: - description: The capabilities to add/drop - when running containers. Defaults - to the default set of capabilities - granted by the container runtime. - Note that this field cannot be set - when spec.os.name is windows. - properties: - add: - description: Added capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - drop: - description: Removed capabilities - items: - description: Capability represent - POSIX capabilities type - type: string - type: array - type: object - privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root - on the host. Defaults to false. - Note that this field cannot be set - when spec.os.name is windows. - type: boolean - procMount: - description: procMount denotes the - type of proc mount to use for the - containers. The default is DefaultProcMount - which uses the container runtime - defaults for readonly paths and - masked paths. This requires the - ProcMountType feature flag to be - enabled. Note that this field cannot - be set when spec.os.name is windows. - type: string - readOnlyRootFilesystem: - description: Whether this container - has a read-only root filesystem. - Default is false. Note that this - field cannot be set when spec.os.name - is windows. - type: boolean - runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If - true, the Kubelet will validate - the image at runtime to ensure that - it does not run as UID 0 (root) - and fail to start the container - if it does. If unset or false, no - such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults - to user specified in image metadata - if unspecified. May also be set - in PodSecurityContext. If set in - both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to - be applied to the container. If - unspecified, the container runtime - will allocate a random SELinux context - for each container. May also be - set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this - field cannot be set when spec.os.name - is windows. - properties: - level: - description: Level is SELinux - level label that applies to - the container. - type: string - role: - description: Role is a SELinux - role label that applies to the - container. - type: string - type: - description: Type is a SELinux - type label that applies to the - container. - type: string - user: - description: User is a SELinux - user label that applies to the - container. - type: string - type: object - seccompProfile: - description: The seccomp options to - use by this container. If seccomp - options are provided at both the - pod & container level, the container - options override the pod options. - Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile - indicates a profile defined - in a file on the node should - be used. The profile must be - preconfigured on the node to - work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must - only be set if type is "Localhost". - type: string - type: - description: "type indicates which - kind of seccomp profile will - be applied. Valid options are: - \n Localhost - a profile defined - in a file on the node should - be used. RuntimeDefault - the - container runtime default profile - should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - windowsOptions: - description: The Windows specific - settings applied to all containers. - If unspecified, the options from - the PodSecurityContext will be used. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set - when spec.os.name is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec - is where the GMSA admission - webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the - GMSA credential spec named by - the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName - is the name of the GMSA credential - spec to use. - type: string - hostProcess: - description: HostProcess determines - if a container should be run - as a 'Host Process' container. - This field is alpha-level and - will only be honored by components - that enable the WindowsHostProcessContainers - feature flag. Setting this field - without the feature flag will - result in errors when validating - the Pod. All of a Pod's containers - must have the same effective - HostProcess value (it is not - allowed to have a mix of HostProcess - containers and non-HostProcess - containers). In addition, if - HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows - to run the entrypoint of the - container process. Defaults - to the user specified in image - metadata if unspecified. May - also be set in PodSecurityContext. - If set in both SecurityContext - and PodSecurityContext, the - value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - startupProbe: - description: 'Deprecated. This field will - be removed in a future release. DeprecatedStartupProbe - indicates that the Pod this Step runs - in has successfully initialized. If - specified, no other probes are executed - until this completes successfully. If - this probe fails, the Pod will be restarted, - just as if the livenessProbe failed. - This can be used to provide different - probe parameters at the beginning of - a Pod''s lifecycle, when it might take - a long time to load data or warm a cache, - than during steady-state operation. - This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - properties: - exec: - description: Exec specifies the action - to take. - properties: - command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. - items: - type: string - type: array - type: object - failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults - to 3. Minimum value is 1. - format: int32 - type: integer - grpc: - description: GRPC specifies an action - involving a GRPC port. This is a - beta field and requires enabling - GRPCContainerProbe feature gate. - properties: - port: - description: Port number of the - gRPC service. Number must be - in the range 1 to 65535. - format: int32 - type: integer - service: - description: "Service is the name - of the service to place in the - gRPC HealthCheckRequest (see - https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, - the default behavior is defined - by gRPC." - type: string - required: - - port - type: object - httpGet: - description: HTTPGet specifies the - http request to perform. - properties: - host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to - set in the request. HTTP allows - repeated headers. - items: - description: HTTPHeader describes - a custom header to be used - in HTTP probes - properties: - name: - description: The header - field name - type: string - value: - description: The header - field value - type: string - required: - - name - - value - type: object - type: array - path: - description: Path to access on - the HTTP server. - type: string - port: - anyOf: - - type: integer - - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. - type: string - required: - - port - type: object - initialDelaySeconds: - description: 'Number of seconds after - the container has started before - liveness probes are initiated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - periodSeconds: - description: How often (in seconds) - to perform the probe. Default to - 10 seconds. Minimum value is 1. - format: int32 - type: integer - successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to - 1. Must be 1 for liveness and startup. - Minimum value is 1. - format: int32 - type: integer - tcpSocket: - description: TCPSocket specifies an - action involving a TCP port. - properties: - host: - description: 'Optional: Host name - to connect to, defaults to the - pod IP.' - type: string - port: - anyOf: - - type: integer - - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. - x-kubernetes-int-or-string: true - required: - - port - type: object - terminationGracePeriodSeconds: - description: Optional duration in - seconds the pod needs to terminate - gracefully upon probe failure. The - grace period is the duration in - seconds after the processes running - in the pod are sent a termination - signal and the time when the processes - are forcibly halted with a kill - signal. Set this value longer than - the expected cleanup time for your - process. If this value is nil, the - pod's terminationGracePeriodSeconds - will be used. Otherwise, this value - overrides the value provided by - the pod spec. Value must be non-negative - integer. The value zero indicates - stop immediately via the kill signal - (no opportunity to shut down). This - is a beta field and requires enabling - ProbeTerminationGracePeriod feature - gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. - format: int64 - type: integer - timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' - format: int32 - type: integer - type: object - stderrConfig: - description: Stores configuration for - the stderr stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - stdin: - description: Deprecated. This field will - be removed in a future release. Whether - this container should allocate a buffer - for stdin in the container runtime. - If this is not set, reads from stdin - in the container will always result - in EOF. Default is false. - type: boolean - stdinOnce: - description: Deprecated. This field will - be removed in a future release. Whether - the container runtime should close the - stdin channel after it has been opened - by a single attach. When stdin is true - the stdin stream will remain open across - multiple attach sessions. If stdinOnce - is set to true, stdin is opened on container - start, is empty until the first client - attaches to stdin, and then remains - open and accepts data until the client - disconnects, at which time stdin is - closed and remains closed until the - container is restarted. If this flag - is false, a container processes that - reads from stdin will never receive - an EOF. Default is false - type: boolean - stdoutConfig: - description: Stores configuration for - the stdout stream of the step. - properties: - path: - description: Path to duplicate stdout - stream to on container's local filesystem. - type: string - type: object - terminationMessagePath: - description: Deprecated. This field will - be removed in a future release and can't - be meaningfully used. - type: string - terminationMessagePolicy: - description: Deprecated. This field will - be removed in a future release and can't - be meaningfully used. - type: string - timeout: - description: 'Timeout is the time after - which the step times out. Defaults to - never. Refer to Go''s ParseDuration - documentation for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - tty: - description: Deprecated. This field will - be removed in a future release. Whether - this container should allocate a DeprecatedTTY - for itself, also requires 'stdin' to - be true. Default is false. - type: boolean - volumeDevices: - description: volumeDevices is the list - of block devices to be used by the Step. - items: - description: volumeDevice describes - a mapping of a raw block device within - a container. - properties: - devicePath: - description: devicePath is the path - inside of the container that the - device will be mapped to. - type: string - name: - description: name must match the - name of a persistentVolumeClaim - in the pod - type: string - required: - - devicePath - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumeMounts: - description: Volumes to mount into the - Step's filesystem. Cannot be updated. - items: - description: VolumeMount describes a - mounting of a Volume within a container. - properties: - mountPath: - description: Path within the container - at which the volume should be - mounted. Must not contain ':'. - type: string - mountPropagation: - description: mountPropagation determines - how mounts are propagated from - the host to container and the - other way around. When not set, - MountPropagationNone is used. - This field is beta in 1.10. - type: string - name: - description: This must match the - Name of a Volume. - type: string - readOnly: - description: Mounted read-only if - true, read-write otherwise (false - or unspecified). Defaults to false. - type: boolean - subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to - "" (volume's root). - type: string - subPathExpr: - description: Expanded path within - the volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) - are expanded using the container's - environment. Defaults to "" (volume's - root). SubPathExpr and SubPath - are mutually exclusive. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - workingDir: - description: Step's working directory. - If not specified, the container runtime's - default will be used, which might be - configured in the container image. Cannot - be updated. - type: string - workspaces: - description: "This is an alpha field. - You must set the \"enable-api-fields\" - feature flag to \"alpha\" for this field - to be supported. \n Workspaces is a - list of workspaces from the Task that - this Step wants exclusive access to. - Adding a workspace to this list means - that any other Step or Sidecar that - does not also request this Workspace - will not have access to it." - items: - description: WorkspaceUsage is used - by a Step or Sidecar to declare that - it wants isolated access to a Workspace - defined in a Task. - properties: - mountPath: - description: MountPath is the path - that the workspace should be mounted - to inside the Step or Sidecar, - overriding any MountPath specified - in the Task's WorkspaceDeclaration. - type: string - name: - description: Name is the name of - the workspace this Step or Sidecar - wants access to. - type: string - required: - - mountPath - - name - type: object - type: array - x-kubernetes-list-type: atomic - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: Volumes is a collection of volumes - that are available to mount into the steps - of the build. - items: - description: Volume represents a named volume - in a pod that may be accessed by any container - in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached - to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can - leave the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true - will force the readOnly setting - in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID - of the persistent disk resource - in AWS (Amazon EBS volume). More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure - Data Disk mount on the host and bind - mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host - Caching mode: None, Read Only, Read - Write.' - type: string - diskName: - description: diskName is the Name - of the data disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of - data disk in the blob storage - type: string - fsType: - description: fsType is Filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - kind: - description: 'kind expected values - are Shared: multiple blob disks - per storage account Dedicated: - single blob disk per storage account Managed: - azure managed data disk (only in - managed availability set). defaults - to shared' - type: string - readOnly: - description: readOnly Defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure - File Service mount on the host and bind - mount to the pod. - properties: - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretName: - description: secretName is the name - of secret that contains Azure Storage - Account Name and Key - type: string - shareName: - description: shareName is the azure - share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph - FS mount on the host that shares a pod's - lifetime - properties: - monitors: - description: 'monitors is Required: - Monitors is a collection of Ceph - monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used - as the mounted root, rather than - the full Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: - Defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring - for User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: - SecretRef is reference to the authentication - secret for User, default is empty. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - user: - description: 'user is optional: User - is the rados user name, default - is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder - volume attached and mounted on kubelets - host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: - points to a secret object containing - parameters used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: - https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions - on created files by default. Must - be an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Defaults - to 0644. Directories within the - path are not affected by this setting. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced ConfigMap - will be projected into the volume - as a file whose name is the key - and content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the ConfigMap, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be - defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is - handled by certain external CSI drivers - (Beta feature). - properties: - driver: - description: driver is the name of - the CSI driver that handles this - volume. Consult with your admin - for the correct name as registered - in the cluster. - type: string - fsType: - description: fsType to mount. Ex. - "ext4", "xfs", "ntfs". If not provided, - the empty value is passed to the - associated CSI driver which will - determine the default filesystem - to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef - is a reference to the secret object - containing sensitive information - to pass to the CSI driver to complete - the CSI NodePublishVolume and NodeUnpublishVolume - calls. This field is optional, and may - be empty if no secret is required. - If the secret object contains more - than one secret, all secret references - are passed. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a - read-only configuration for the - volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores - driver-specific properties that - are passed to the CSI driver. Consult - your driver's documentation for - supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward - API about the pod that should populate - this volume - properties: - defaultMode: - description: 'Optional: mode bits - to use on created files by default. - Must be a Optional: mode bits used - to set permissions on created files - by default. Must be an octal value - between 0000 and 0777 or a decimal - value between 0 and 511. YAML accepts - both octal and decimal values, JSON - requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected - by this setting. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward - API volume file - items: - description: DownwardAPIVolumeFile - represents information to create - the file containing the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode - bits used to set permissions - on this file, must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path - is the relative path name - of the file to be created. - Must not be absolute or contain - the ''..'' path. Must be utf-8 - encoded. The first item of - the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what - type of storage medium should back - this directory. The default is "" - which means to use the node''s default - medium. Must be an empty string - (default) or Memory. More info: - https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total - amount of local storage required - for this EmptyDir volume. The size - limit is also applicable for memory - medium. The maximum usage on memory - medium EmptyDir would be the minimum - value between the SizeLimit specified - here and the sum of memory limits - of all containers in a pod. The - default is nil which means that - the limit is undefined. More info: - http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage - driver. The volume's lifecycle is tied - to the pod that defines it - it will - be created before the pod starts, and - deleted when the pod is removed. \n - Use this if: a) the volume is only needed - while the pod runs, b) features of normal - volumes like restoring from snapshot - or capacity tracking are needed, - c) the storage driver is specified through - a storage class, and d) the storage - driver supports dynamic volume provisioning - through a PersistentVolumeClaim (see - EphemeralVolumeSource for more information - on the connection between this volume - type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one - of the vendor-specific APIs for volumes - that persist for longer than the lifecycle - of an individual pod. \n Use CSI for - light-weight local ephemeral volumes - if the CSI driver is meant to be used - that way - see the documentation of - the driver for more information. \n - A pod can use both types of ephemeral - volumes and persistent volumes at the - same time." - properties: - volumeClaimTemplate: - description: "Will be used to create - a stand-alone PVC to provision the - volume. The pod in which this EphemeralVolumeSource - is embedded will be the owner of - the PVC, i.e. the PVC will be deleted - together with the pod. The name - of the PVC will be `-` where `` is - the name from the `PodSpec.Volumes` - array entry. Pod validation will - reject the pod if the concatenated - name is not valid for a PVC (for - example, too long). \n An existing - PVC with that name that is not owned - by the pod will *not* be used for - the pod to avoid using an unrelated - volume by mistake. Starting the - pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod - exists. Normally this should not - be necessary, but it may be useful - when manually reconstructing a broken - cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels - and annotations that will be - copied into the PVC when creating - it. No other fields are allowed - and will be rejected during - validation. - type: object - spec: - description: The specification - for the PersistentVolumeClaim. - The entire content is copied - unchanged into the PVC that - gets created from this template. - The same fields as in a PersistentVolumeClaim - are also valid here. - properties: - accessModes: - description: 'accessModes - contains the desired access - modes the volume should - have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an - external controller can - support the specified data - source, it will create a - new volume based on the - contents of the specified - data source. If the AnyVolumeDataSource - feature gate is enabled, - this field will always have - the same contents as the - DataSourceRef field.' - properties: - apiGroup: - description: APIGroup - is the group for the - resource being referenced. - If APIGroup is not specified, - the specified Kind must - be in the core API group. - For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the - type of resource being - referenced - type: string - name: - description: Name is the - name of resource being - referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef - specifies the object from - which to populate the volume - with data, if a non-empty - volume is desired. This - may be any local object - from a non-empty API group - (non core object) or a PersistentVolumeClaim - object. When this field - is specified, volume binding - will only succeed if the - type of the specified object - matches some installed volume - populator or dynamic provisioner. - This field will replace - the functionality of the - DataSource field and as - such if both fields are - non-empty, they must have - the same value. For backwards - compatibility, both fields - (DataSource and DataSourceRef) - will be set to the same - value automatically if one - of them is empty and the - other is non-empty. There - are two important differences - between DataSource and DataSourceRef: - * While DataSource only - allows two specific types - of objects, DataSourceRef allows - any non-core object, as - well as PersistentVolumeClaim - objects. * While DataSource - ignores disallowed values - (dropping them), DataSourceRef preserves - all values, and generates - an error if a disallowed - value is specified. (Beta) - Using this field requires - the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup - is the group for the - resource being referenced. - If APIGroup is not specified, - the specified Kind must - be in the core API group. - For any other third-party - types, APIGroup is required. - type: string - kind: - description: Kind is the - type of resource being - referenced - type: string - name: - description: Name is the - name of resource being - referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the - volume should have. If RecoverVolumeExpansionFailure - feature is enabled users - are allowed to specify resource - requirements that are lower - than previous value but - must still be higher than - capacity recorded in the - status field of the claim. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of - compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests - describes the minimum - amount of compute resources - required. If Requests - is omitted for a container, - it defaults to Limits - if that is explicitly - specified, otherwise - to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a - label query over volumes - to consider for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label - selector requirement - is a selector that - contains values, a - key, and an operator - that relates the key - and values. - properties: - key: - description: key - is the label key - that the selector - applies to. - type: string - operator: - description: operator - represents a key's - relationship to - a set of values. - Valid operators - are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values - is an array of - string values. - If the operator - is In or NotIn, - the values array - must be non-empty. - If the operator - is Exists or DoesNotExist, - the values array - must be empty. - This array is - replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels - is a map of {key,value} - pairs. A single {key,value} - in the matchLabels map - is equivalent to an - element of matchExpressions, - whose key field is "key", - the operator is "In", - and the values array - contains only "value". - The requirements are - ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is - the binding reference to - the PersistentVolume backing - this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel - resource that is attached to a kubelet's - host machine and then exposed to the - pod. - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. TODO: how do we - prevent errors in the filesystem - from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC - target lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: - Defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: - FC target worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs - and lun must be set, but not both - simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. - properties: - driver: - description: driver is the name of - the driver to use for this volume. - type: string - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - The default filesystem depends on - FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: - this field holds extra command options - if any.' - type: object - readOnly: - description: 'readOnly is Optional: - defaults to false (read/write). - ReadOnly here will force the ReadOnly - setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: - secretRef is reference to the secret - object containing sensitive information - to pass to the plugin scripts. This - may be empty if no secret object - is specified. If the secret object - contains more than one secret, all - secrets are passed to the plugin - scripts.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker - volume attached to a kubelet's host - machine. This depends on the Flocker - control service being running - properties: - datasetName: - description: datasetName is Name of - the dataset stored as metadata -> - name on the dataset for Flocker - should be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID - of the dataset. This is unique identifier - of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached - to a kubelet''s host machine and then - exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can - leave the property empty). More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name - of the PD resource in GCE. Used - to identify the disk in GCE. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git - repository at a particular revision. - DEPRECATED: GitRepo is deprecated. To - provision a container with a git repo, - mount an EmptyDir into an InitContainer - that clones the repo using git, then - mount the EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target - directory name. Must not contain - or start with '..'. If '.' is supplied, - the volume directory will be the - git repository. Otherwise, if specified, - the volume will contain the git - repository in the subdirectory with - the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit - hash for the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs - volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted - with read-only permissions. Defaults - to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine - that is directly exposed to the container. - This is generally used for system agents - or other privileged things that are - allowed to see the host machine. Most - containers will NOT need this. More - info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict - who can use host directory mounts and - who can/can not mount host directories - as read/write.' - properties: - path: - description: 'path of the directory - on the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI - Disk resource that is attached to a - kubelet''s host machine and then exposed - to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines - whether support iSCSI Discovery - CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines - whether support iSCSI Session CHAP - authentication - type: boolean - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - initiatorName: - description: initiatorName is the - custom iSCSI Initiator Name. If - initiatorName is specified with - iscsiInterface simultaneously, new - iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI - Qualified Name. - type: string - iscsiInterface: - description: iscsiInterface is the - interface Name that uses an iSCSI - transport. Defaults to 'default' - (tcp). - type: string - lun: - description: lun represents iSCSI - Target Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI - Target Portal List. The portal is - either an IP or ip_addr:port if - the port is other than default (typically - TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP - Secret for iSCSI target and initiator - authentication - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI - Target Portal. The Portal is either - an IP or ip_addr:port if the port - is other than default (typically - TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must - be a DNS_LABEL and unique within the - pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported - by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force - the NFS export to be mounted with - read-only permissions. Defaults - to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname - or IP address of the NFS server. - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name - of a PersistentVolumeClaim in the - same namespace as the pod using - this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the - ReadOnly setting in VolumeMounts. - Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents - a PhotonController persistent disk attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents - a portworx volume attached and mounted - on kubelets host machine - properties: - fsType: - description: fSType represents the - filesystem type to mount Must be - a filesystem type supported by the - host operating system. Ex. "ext4", - "xfs". Implicitly inferred to be - "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in - one resources secrets, configmaps, and - downward API - properties: - defaultMode: - description: defaultMode are the mode - bits used to set permissions on - created files by default. Must be - an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected - by this setting. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set. - format: int32 - type: integer - sources: - description: sources is the list of - volume projections - items: - description: Projection that may - be projected along with other - supported volume types - properties: - configMap: - description: configMap information - about the configMap data to - project - properties: - items: - description: items if unspecified, - each key-value pair in - the Data field of the - referenced ConfigMap will - be projected into the - volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be - projected into the specified - paths, and unlisted keys - will not be present. If - a key is specified which - is not present in the - ConfigMap, the volume - setup will error unless - it is marked optional. - Paths must be relative - and may not contain the - '..' path or start with - '..'. - items: - description: Maps a string - key to a path within - a volume. - properties: - key: - description: key is - the key to project. - type: string - mode: - description: 'mode - is Optional: mode - bits used to set - permissions on this - file. Must be an - octal value between - 0000 and 0777 or - a decimal value - between 0 and 511. - YAML accepts both - octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: path - is the relative - path of the file - to map the key to. - May not be an absolute - path. May not contain - the path element - '..'. May not start - with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional specify - whether the ConfigMap - or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data - to project - properties: - items: - description: Items is a - list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile - represents information - to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: - Selects a field - of the pod: only - annotations, labels, - name and namespace - are supported.' - properties: - apiVersion: - description: Version - of the schema - the FieldPath - is written in - terms of, defaults - to "v1". - type: string - fieldPath: - description: Path - of the field - to select in - the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: - mode bits used to - set permissions - on this file, must - be an octal value - between 0000 and - 0777 or a decimal - value between 0 - and 511. YAML accepts - both octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: - Path is the relative - path name of the - file to be created. - Must not be absolute - or contain the ''..'' - path. Must be utf-8 - encoded. The first - item of the relative - path must not start - with ''..''' - type: string - resourceFieldRef: - description: 'Selects - a resource of the - container: only - resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container - name: required - for volumes, - optional for - env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format - of the exposed - resources, defaults - to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to - select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information - about the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in - the Data field of the - referenced Secret will - be projected into the - volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be - projected into the specified - paths, and unlisted keys - will not be present. If - a key is specified which - is not present in the - Secret, the volume setup - will error unless it is - marked optional. Paths - must be relative and may - not contain the '..' path - or start with '..'. - items: - description: Maps a string - key to a path within - a volume. - properties: - key: - description: key is - the key to project. - type: string - mode: - description: 'mode - is Optional: mode - bits used to set - permissions on this - file. Must be an - octal value between - 0000 and 0777 or - a decimal value - between 0 and 511. - YAML accepts both - octal and decimal - values, JSON requires - decimal values for - mode bits. If not - specified, the volume - defaultMode will - be used. This might - be in conflict with - other options that - affect the file - mode, like fsGroup, - and the result can - be other mode bits - set.' - format: int32 - type: integer - path: - description: path - is the relative - path of the file - to map the key to. - May not be an absolute - path. May not contain - the path element - '..'. May not start - with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the - referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful - fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional field - specify whether the Secret - or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken - is information about the serviceAccountToken - data to project - properties: - audience: - description: audience is - the intended audience - of the token. A recipient - of a token must identify - itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. - The audience defaults - to the identifier of the - apiserver. - type: string - expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the - token approaches expiration, - the kubelet volume plugin - will proactively rotate - the service account token. - The kubelet will start - trying to rotate the token - if the token is older - than 80 percent of its - time to live or if the - token is older than 24 - hours.Defaults to 1 hour - and must be at least 10 - minutes. - format: int64 - type: integer - path: - description: path is the - path relative to the mount - point of the file to project - the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte - mount on the host that shares a pod's - lifetime - properties: - group: - description: group to map volume access - to Default is no group - type: string - readOnly: - description: readOnly here will force - the Quobyte volume to be mounted - with read-only permissions. Defaults - to false. - type: boolean - registry: - description: registry represents a - single or multiple Quobyte Registry - services specified as a string as - host:port pair (multiple entries - are separated with commas) which - acts as the central registry for - volumes - type: string - tenant: - description: tenant owning the given - Quobyte volume in the Backend Used - with dynamically provisioned Quobyte - volumes, value is set by the plugin - type: string - user: - description: user to map volume access - to Defaults to serivceaccount user - type: string - volume: - description: volume is a string that - references an already created Quobyte - volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares - a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want - to mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be - "ext4" if unspecified. More info: - https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in - the filesystem from compromising - the machine' - type: string - image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path - to key ring for RBDUser. Default - is /etc/ceph/keyring. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool - name. Default is rbd. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of - the authentication secret for RBDUser. - If provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - user: - description: 'user is the rados user - name. Default is admin. More info: - https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO - persistent volume attached and mounted - on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Default is "xfs". - type: string - gateway: - description: gateway is the host address - of the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the - name of the ScaleIO Protection Domain - for the configured storage. - type: string - readOnly: - description: readOnly Defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef references - to the secret for ScaleIO user and - other sensitive information. If - this is not provided, Login operation - will fail. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, - default false - type: boolean - storageMode: - description: storageMode indicates - whether the storage for a volume - should be ThickProvisioned or ThinProvisioned. - Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO - Storage Pool associated with the - protection domain. - type: string - system: - description: system is the name of - the storage system as configured - in ScaleIO. - type: string - volumeName: - description: volumeName is the name - of a volume already created in the - ScaleIO system that is associated - with this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret - that should populate this volume. More - info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions - on created files by default. Must - be an octal value between 0000 and - 0777 or a decimal value between - 0 and 511. YAML accepts both octal - and decimal values, JSON requires - decimal values for mode bits. Defaults - to 0644. Directories within the - path are not affected by this setting. - This might be in conflict with other - options that affect the file mode, - like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, - each key-value pair in the Data - field of the referenced Secret will - be projected into the volume as - a file whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the Secret, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify - whether the Secret or its keys must - be defined - type: boolean - secretName: - description: 'secretName is the name - of the secret in the pod''s namespace - to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes - nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: readOnly defaults to - false (read/write). ReadOnly here - will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the - secret to use for obtaining the - StorageOS API credentials. If not - specified, default values will be - attempted. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume - names are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the - Pod's namespace will be used. This - allows the Kubernetes name scoping - to be mirrored within StorageOS - for tighter integration. Set VolumeName - to any name to override the default - behaviour. Set to "default" if you - are not using namespaces within - StorageOS. Namespaces that do not - pre-exist within StorageOS will - be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents - a vSphere volume attached and mounted - on kubelets host machine - properties: - fsType: - description: fsType is filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" - if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the - storage Policy Based Management - (SPBM) profile ID associated with - the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is - the storage Policy Based Management - (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path - that identifies vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces are the volumes that - this Task requires. - items: - description: WorkspaceDeclaration is a declaration - of a volume that a Task requires. - properties: - description: - description: Description is an optional - human readable description of this volume. - type: string - mountPath: - description: MountPath overrides the directory - that the volume will be made available - at. - type: string - name: - description: Name is the name by which - you can bind the volume at runtime. - type: string - optional: - description: Optional marks a Workspace - as not being required in TaskRuns. By - default this field is false and so declared - workspaces are required. - type: boolean - readOnly: - description: ReadOnly dictates whether - a mounted volume is writable. By default - this field is false and so mounted volumes - are writable. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - timeout: - description: 'Time after which the TaskRun times - out. Defaults to 1 hour. Specified TaskRun timeout - should be less than 24h. Refer Go''s ParseDuration - documentation for expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - when: - description: WhenExpressions is a list of when expressions - that need to be true for the task to run - items: - description: WhenExpression allows a PipelineTask - to declare expressions to be evaluated before - the Task is run to determine whether the Task - should be executed or skipped - properties: - input: - description: Input is the string for guard - checking which can be a static input or - an output from a parent Task - type: string - operator: - description: Operator that represents an Input's - relationship to the values - type: string - values: - description: Values is an array of strings, - which is compared against the input, for - guard checking It must be non-empty - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - input - - operator - - values - type: object - type: array - workspaces: - description: Workspaces maps workspaces from the - pipeline spec to the workspaces declared in the - Task. - items: - description: WorkspacePipelineTaskBinding describes - how a workspace passed into the pipeline should - be mapped to a task's declared workspace. - properties: - name: - description: Name is the name of the workspace - as declared by the task - type: string - subPath: - description: SubPath is optionally a directory - on the volume which should be used for this - binding (i.e. the volume will be mounted - at this sub directory). - type: string - workspace: - description: Workspace is the name of the - workspace declared by the pipeline - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: array - x-kubernetes-list-type: atomic - workspaces: - description: Workspaces declares a set of named workspaces - that are expected to be provided by a PipelineRun. - items: - description: PipelineWorkspaceDeclaration creates a - named slot in a Pipeline that a PipelineRun is expected - to populate with a workspace binding. - properties: - description: - description: Description is a human readable string - describing how the workspace will be used in the - Pipeline. It can be useful to include a bit of - detail about which tasks are intended to have - access to the data on the workspace. - type: string - name: - description: Name is the name of a workspace to - be provided by a PipelineRun. - type: string - optional: - description: Optional marks a Workspace as not being - required in PipelineRuns. By default this field - is false and so declared workspaces are required. - type: boolean - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podTemplate: - description: PodTemplate holds pod specific configuration - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules - for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose a - node that violates one or more of the expressions. - The node that is most preferred is the one with - the greatest sum of weights, i.e. for each node - that meets all of the scheduling requirements - (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum by - iterating through the elements of this field - and adding "weight" to the sum if the node matches - the corresponding matchExpressions; the node(s) - with the highest sum are the most preferred. - items: - description: An empty preferred scheduling term - matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling - term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated - with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: An array of string - values. If the operator is In - or NotIn, the values array must - be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - If the operator is Gt or Lt, - the values array must have a - single element, which will be - interpreted as an integer. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: An array of string - values. If the operator is In - or NotIn, the values array must - be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - If the operator is Gt or Lt, - the values array must have a - single element, which will be - interpreted as an integer. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - weight: - description: Weight associated with matching - the corresponding nodeSelectorTerm, in - the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, - the pod will not be scheduled onto the node. - If the affinity requirements specified by this - field cease to be met at some point during pod - execution (e.g. due to an update), the system - may or may not try to eventually evict the pod - from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector - terms. The terms are ORed. - items: - description: A null or empty node selector - term matches no objects. The requirements - of them are ANDed. The TopologySelectorTerm - type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: An array of string - values. If the operator is In - or NotIn, the values array must - be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - If the operator is Gt or Lt, - the values array must have a - single element, which will be - interpreted as an integer. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: The label key that - the selector applies to. - type: string - operator: - description: Represents a key's - relationship to a set of values. - Valid operators are In, NotIn, - Exists, DoesNotExist. Gt, and - Lt. - type: string - values: - description: An array of string - values. If the operator is In - or NotIn, the values array must - be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - If the operator is Gt or Lt, - the values array must have a - single element, which will be - interpreted as an integer. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - type: array - required: - - nodeSelectorTerms - type: object - type: object - podAffinity: - description: Describes pod affinity scheduling rules - (e.g. co-locate this pod in the same node, zone, - etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the affinity expressions - specified by this field, but it may choose a - node that violates one or more of the expressions. - The node that is most preferred is the one with - the greatest sum of weights, i.e. for each node - that meets all of the scheduling requirements - (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a sum by - iterating through the elements of this field - and adding "weight" to the sum if the node has - pods which matches the corresponding podAffinityTerm; - the node(s) with the highest sum are the most - preferred. - items: - description: The weights of all of the matched - WeightedPodAffinityTerm fields are added per-node - to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, - associated with the corresponding weight. - properties: - labelSelector: - description: A label query over a set - of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is - a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector - requirement is a selector that - contains values, a key, and - an operator that relates the - key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In or - NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be - empty. This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single - {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator is - "In", and the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term applies - to. The term is applied to the union - of the namespaces selected by this - field and the ones listed in the namespaces - field. null selector and null or empty - namespaces list means "this pod's - namespace". An empty selector ({}) - matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is - a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector - requirement is a selector that - contains values, a key, and - an operator that relates the - key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In or - NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be - empty. This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single - {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator is - "In", and the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a - static list of namespace names that - the term applies to. The term is applied - to the union of the namespaces listed - in this field and the ones selected - by namespaceSelector. null or empty - namespaces list and null namespaceSelector - means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running on - a node whose value of the label with - key topologyKey matches that of any - node on which any of the selected - pods is running. Empty topologyKey - is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in - the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements specified - by this field are not met at scheduling time, - the pod will not be scheduled onto the node. - If the affinity requirements specified by this - field cease to be met at some point during pod - execution (e.g. due to a pod label update), - the system may or may not try to eventually - evict the pod from its node. When there are - multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. - items: - description: Defines a set of pods (namely those - matching the labelSelector relative to the - given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) - with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on - which a pod of the set of pods is running - properties: - labelSelector: - description: A label query over a set of - resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies to. - The term is applied to the union of the - namespaces selected by this field and - the ones listed in the namespaces field. - null selector and null or empty namespaces - list means "this pod's namespace". An - empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling - rules (e.g. avoid putting this pod in the same node, - zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to schedule - pods to nodes that satisfy the anti-affinity - expressions specified by this field, but it - may choose a node that violates one or more - of the expressions. The node that is most preferred - is the one with the greatest sum of weights, - i.e. for each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - anti-affinity expressions, etc.), compute a - sum by iterating through the elements of this - field and adding "weight" to the sum if the - node has pods which matches the corresponding - podAffinityTerm; the node(s) with the highest - sum are the most preferred. - items: - description: The weights of all of the matched - WeightedPodAffinityTerm fields are added per-node - to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, - associated with the corresponding weight. - properties: - labelSelector: - description: A label query over a set - of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is - a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector - requirement is a selector that - contains values, a key, and - an operator that relates the - key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In or - NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be - empty. This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single - {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator is - "In", and the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term applies - to. The term is applied to the union - of the namespaces selected by this - field and the ones listed in the namespaces - field. null selector and null or empty - namespaces list means "this pod's - namespace". An empty selector ({}) - matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is - a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector - requirement is a selector that - contains values, a key, and - an operator that relates the - key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In or - NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be - empty. This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single - {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator is - "In", and the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a - static list of namespace names that - the term applies to. The term is applied - to the union of the namespaces listed - in this field and the ones selected - by namespaceSelector. null or empty - namespaces list and null namespaceSelector - means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running on - a node whose value of the label with - key topologyKey matches that of any - node on which any of the selected - pods is running. Empty topologyKey - is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with matching - the corresponding podAffinityTerm, in - the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements - specified by this field are not met at scheduling - time, the pod will not be scheduled onto the - node. If the anti-affinity requirements specified - by this field cease to be met at some point - during pod execution (e.g. due to a pod label - update), the system may or may not try to eventually - evict the pod from its node. When there are - multiple elements, the lists of nodes corresponding - to each podAffinityTerm are intersected, i.e. - all terms must be satisfied. - items: - description: Defines a set of pods (namely those - matching the labelSelector relative to the - given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) - with, where co-located is defined as running - on a node whose value of the label with key - matches that of any node on - which a pod of the set of pods is running - properties: - labelSelector: - description: A label query over a set of - resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the set - of namespaces that the term applies to. - The term is applied to the union of the - namespaces selected by this field and - the ones listed in the namespaces field. - null selector and null or empty namespaces - list means "this pod's namespace". An - empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. - This array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of - {key,value} pairs. A single {key,value} - in the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are - ANDed. - type: object - type: object - namespaces: - description: namespaces specifies a static - list of namespace names that the term - applies to. The term is applied to the - union of the namespaces listed in this - field and the ones selected by namespaceSelector. - null or empty namespaces list and null - namespaceSelector means "this pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where co-located - is defined as running on a node whose - value of the label with key topologyKey - matches that of any node on which any - of the selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether - pods running as this service account should have an - API token automatically mounted. - type: boolean - dnsConfig: - description: Specifies the DNS parameters of a pod. Parameters - specified here will be merged to the generated DNS configuration - based on DNSPolicy. - properties: - nameservers: - description: A list of DNS name server IP addresses. - This will be appended to the base nameservers generated - from DNSPolicy. Duplicated nameservers will be removed. - items: - type: string - type: array - options: - description: A list of DNS resolver options. This - will be merged with the base options generated from - DNSPolicy. Duplicated entries will be removed. Resolution - options given in Options will override those that - appear in the base DNSPolicy. - items: - description: PodDNSConfigOption defines DNS resolver - options of a pod. - properties: - name: - description: Required. - type: string - value: - type: string - type: object - type: array - searches: - description: A list of DNS search domains for host-name - lookup. This will be appended to the base search - paths generated from DNSPolicy. Duplicated search - paths will be removed. - items: - type: string - type: array - type: object - dnsPolicy: - description: Set DNS policy for the pod. Defaults to "ClusterFirst". - Valid values are 'ClusterFirst', 'Default' or 'None'. - DNS parameters given in DNSConfig will be merged with - the policy selected with DNSPolicy. - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information - about services should be injected into pod''s environment - variables, matching the syntax of Docker links. Optional: - Defaults to true.' - type: boolean - env: - description: List of environment variables that can be - provided to the containers belonging to the pod. - items: - description: EnvVar represents an environment variable - present in a Container. - properties: - name: - description: Name of the environment variable. Must - be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) are - expanded using the previously defined environment - variables in the container and any service environment - variables. If a variable cannot be resolved, the - reference in the input string will be unchanged. - Double $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" - will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless - of whether the variable exists or not. Defaults - to "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: supports - metadata.name, metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, spec.nodeName, - spec.serviceAccountName, status.hostIP, status.podIP, - status.podIPs.' - properties: - apiVersion: - description: Version of the schema the FieldPath - is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select - in the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the container: - only resources limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required for - volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output format - of the exposed resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret in the - pod's namespace - properties: - key: - description: The key of the secret to select - from. Must be a valid secret key. - type: string - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret - or its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - hostAliases: - description: HostAliases is an optional list of hosts - and IPs that will be injected into the pod's hosts file - if specified. This is only valid for non-hostNetwork - pods. - items: - description: HostAlias holds the mapping between IP - and hostnames that will be injected as an entry in - the pod's hosts file. - properties: - hostnames: - description: Hostnames for the above IP address. - items: - type: string - type: array - ip: - description: IP address of the host file entry. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - hostNetwork: - description: HostNetwork specifies whether the pod may - use the node network namespace - type: boolean - imagePullSecrets: - description: ImagePullSecrets gives the name of the secret - used by the pod to pull the image if specified - items: - description: LocalObjectReference contains enough information - to let you locate the referenced object inside the - same namespace. - properties: - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - type: object - type: array - x-kubernetes-list-type: atomic - nodeSelector: - additionalProperties: - type: string - description: 'NodeSelector is a selector which must be - true for the pod to fit on a node. Selector which must - match a node''s labels for the pod to be scheduled on - that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - priorityClassName: - description: If specified, indicates the pod's priority. - "system-node-critical" and "system-cluster-critical" - are two special keywords which indicate the highest - priorities with the former being the highest priority. - Any other name must be defined by creating a PriorityClass - object with that name. If not specified, the pod priority - will be default or zero if there is no default. - type: string - runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass - object in the node.k8s.io group, which should be used - to run this pod. If no RuntimeClass resource matches - the named class, the pod will not be run. If unset or - empty, the "legacy" RuntimeClass will be used, which - is an implicit class with an empty definition that uses - the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md - This is a beta feature as of Kubernetes v1.14.' - type: string - schedulerName: - description: SchedulerName specifies the scheduler to - be used to dispatch the Pod - type: string - securityContext: - description: 'SecurityContext holds pod-level security - attributes and common container settings. Optional: - Defaults to empty. See type description for default - values of each field.' - properties: - fsGroup: - description: "A special supplemental group that applies - to all containers in a pod. Some volume types allow - the Kubelet to change the ownership of that volume - to be owned by the pod: \n 1. The owning GID will - be the FSGroup 2. The setgid bit is set (new files - created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- \n - If unset, the Kubelet will not modify the ownership - and permissions of any volume. Note that this field - cannot be set when spec.os.name is windows." - format: int64 - type: integer - fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior - of changing ownership and permission of the volume - before being exposed inside Pod. This field will - only apply to volume types which support fsGroup - based ownership(and permissions). It will have no - effect on ephemeral volume types such as: secret, - configmaps and emptydir. Valid values are "OnRootMismatch" - and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name - is windows.' - type: string - runAsGroup: - description: The GID to run the entrypoint of the - container process. Uses runtime default if unset. - May also be set in SecurityContext. If set in both - SecurityContext and PodSecurityContext, the value - specified in SecurityContext takes precedence for - that container. Note that this field cannot be set - when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must run - as a non-root user. If true, the Kubelet will validate - the image at runtime to ensure that it does not - run as UID 0 (root) and fail to start the container - if it does. If unset or false, no such validation - will be performed. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of the - container process. Defaults to user specified in - image metadata if unspecified. May also be set in - SecurityContext. If set in both SecurityContext - and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. Note that this - field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied to - all containers. If unspecified, the container runtime - will allocate a random SELinux context for each - container. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence - for that container. Note that this field cannot - be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that - applies to the container. - type: string - role: - description: Role is a SELinux role label that - applies to the container. - type: string - type: - description: Type is a SELinux type label that - applies to the container. - type: string - user: - description: User is a SELinux user label that - applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by the containers - in this pod. Note that this field cannot be set - when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates a profile - defined in a file on the node should be used. - The profile must be preconfigured on the node - to work. Must be a descending path, relative - to the kubelet's configured seccomp profile - location. Must only be set if type is "Localhost". - type: string - type: - description: "type indicates which kind of seccomp - profile will be applied. Valid options are: - \n Localhost - a profile defined in a file on - the node should be used. RuntimeDefault - the - container runtime default profile should be - used. Unconfined - no profile should be applied." - type: string - required: - - type - type: object - supplementalGroups: - description: A list of groups applied to the first - process run in each container, in addition to the - container's primary GID. If unspecified, no groups - will be added to any container. Note that this field - cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - sysctls: - description: Sysctls hold a list of namespaced sysctls - used for the pod. Pods with unsupported sysctls - (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name - is windows. - items: - description: Sysctl defines a kernel parameter to - be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - windowsOptions: - description: The Windows specific settings applied - to all containers. If unspecified, the options within - a container's SecurityContext will be used. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name - is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where the GMSA - admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the name - of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a container - should be run as a 'Host Process' container. - This field is alpha-level and will only be honored - by components that enable the WindowsHostProcessContainers - feature flag. Setting this field without the - feature flag will result in errors when validating - the Pod. All of a Pod's containers must have - the same effective HostProcess value (it is - not allowed to have a mix of HostProcess containers - and non-HostProcess containers). In addition, - if HostProcess is true then HostNetwork must - also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to run the - entrypoint of the container process. Defaults - to the user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence. - type: string - type: object - type: object - tolerations: - description: If specified, the pod's tolerations. - items: - description: The pod this Toleration is attached to - tolerates any taint that matches the triple - using the matching operator . - properties: - effect: - description: Effect indicates the taint effect to - match. Empty means match all taint effects. When - specified, allowed values are NoSchedule, PreferNoSchedule - and NoExecute. - type: string - key: - description: Key is the taint key that the toleration - applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; - this combination means to match all values and - all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists and Equal. - Defaults to Equal. Exists is equivalent to wildcard - for value, so that a pod can tolerate all taints - of a particular category. - type: string - tolerationSeconds: - description: TolerationSeconds represents the period - of time the toleration (which must be of effect - NoExecute, otherwise this field is ignored) tolerates - the taint. By default, it is not set, which means - tolerate the taint forever (do not evict). Zero - and negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the toleration - matches to. If the operator is Exists, the value - should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - topologySpreadConstraints: - description: TopologySpreadConstraints controls how Pods - are spread across your cluster among failure-domains - such as regions, zones, nodes, and other user-defined - topology domains. - items: - description: TopologySpreadConstraint specifies how - to spread matching pods among the given topology. - properties: - labelSelector: - description: LabelSelector is used to find matching - pods. Pods that match this label selector are - counted to determine the number of pods in their - corresponding topology domain. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: A label selector requirement - is a selector that contains values, a key, - and an operator that relates the key and - values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: operator represents a key's - relationship to a set of values. Valid - operators are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an array of string - values. If the operator is In or NotIn, - the values array must be non-empty. - If the operator is Exists or DoesNotExist, - the values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator is - "In", and the values array contains only "value". - The requirements are ANDed. - type: object - type: object - matchLabelKeys: - description: MatchLabelKeys is a set of pod label - keys to select the pods over which spreading will - be calculated. The keys are used to lookup values - from the incoming pod labels, those key-value - labels are ANDed with labelSelector to select - the group of existing pods over which spreading - will be calculated for the incoming pod. Keys - that don't exist in the incoming pod labels will - be ignored. A null or empty list means only match - against labelSelector. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: 'MaxSkew describes the degree to which - pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, - it is the maximum permitted difference between - the number of matching pods in the target topology - and the global minimum. The global minimum is - the minimum number of matching pods in an eligible - domain or zero if the number of eligible domains - is less than MinDomains. For example, in a 3-zone - cluster, MaxSkew is set to 1, and pods with the - same labelSelector spread as 2/2/1: In this case, - the global minimum is 1. | zone1 | zone2 | zone3 - | | P P | P P | P | - if MaxSkew is 1, - incoming pod can only be scheduled to zone3 to - become 2/2/2; scheduling it onto zone1(zone2) - would make the ActualSkew(3-1) on zone1(zone2) - violate MaxSkew(1). - if MaxSkew is 2, incoming - pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to topologies - that satisfy it. It''s a required field. Default - value is 1 and 0 is not allowed.' - format: int32 - type: integer - minDomains: - description: "MinDomains indicates a minimum number - of eligible domains. When the number of eligible - domains with matching topology keys is less than - minDomains, Pod Topology Spread treats \"global - minimum\" as 0, and then the calculation of Skew - is performed. And when the number of eligible - domains with matching topology keys equals or - greater than minDomains, this value has no effect - on scheduling. As a result, when the number of - eligible domains is less than minDomains, scheduler - won't schedule more than maxSkew Pods to those - domains. If value is nil, the constraint behaves - as if MinDomains is equal to 1. Valid values are - integers greater than 0. When value is not nil, - WhenUnsatisfiable must be DoNotSchedule. \n For - example, in a 3-zone cluster, MaxSkew is set to - 2, MinDomains is set to 5 and pods with the same - labelSelector spread as 2/2/2: | zone1 | zone2 - | zone3 | | P P | P P | P P | The number - of domains is less than 5(MinDomains), so \"global - minimum\" is treated as 0. In this situation, - new pod with the same labelSelector cannot be - scheduled, because computed skew will be 3(3 - - 0) if new Pod is scheduled to any of the three - zones, it will violate MaxSkew. \n This is a beta - field and requires the MinDomainsInPodTopologySpread - feature gate to be enabled (enabled by default)." - format: int32 - type: integer - nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates how we - will treat Pod's nodeAffinity/nodeSelector when - calculating pod topology spread skew. Options - are: - Honor: only nodes matching nodeAffinity/nodeSelector - are included in the calculations. - Ignore: nodeAffinity/nodeSelector - are ignored. All nodes are included in the calculations. - \n If this value is nil, the behavior is equivalent - to the Honor policy. This is a alpha-level feature - enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how we - will treat node taints when calculating pod topology - spread skew. Options are: - Honor: nodes without - taints, along with tainted nodes for which the - incoming pod has a toleration, are included. - - Ignore: node taints are ignored. All nodes are - included. \n If this value is nil, the behavior - is equivalent to the Ignore policy. This is a - alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - topologyKey: - description: TopologyKey is the key of node labels. - Nodes that have a label with this key and identical - values are considered to be in the same topology. - We consider each as a "bucket", and - try to put balanced number of pods into each bucket. - We define a domain as a particular instance of - a topology. Also, we define an eligible domain - as a domain whose nodes meet the requirements - of nodeAffinityPolicy and nodeTaintsPolicy. e.g. - If TopologyKey is "kubernetes.io/hostname", each - Node is a domain of that topology. And, if TopologyKey - is "topology.kubernetes.io/zone", each zone is - a domain of that topology. It's a required field. - type: string - whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates how to - deal with a pod if it doesn''t satisfy the spread - constraint. - DoNotSchedule (default) tells the - scheduler not to schedule it. - ScheduleAnyway - tells the scheduler to schedule the pod in any - location, but giving higher precedence to topologies - that would help reduce the skew. A constraint - is considered "Unsatisfiable" for an incoming - pod if and only if every possible node assignment - for that pod would violate "MaxSkew" on some topology. - For example, in a 3-zone cluster, MaxSkew is set - to 1, and pods with the same labelSelector spread - as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | - If WhenUnsatisfiable is set to DoNotSchedule, - incoming pod can only be scheduled to zone2(zone3) - to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) - satisfies MaxSkew(1). In other words, the cluster - can still be imbalanced, but scheduler won''t - make it *more* imbalanced. It''s a required field.' - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: 'List of volumes that can be mounted by containers - belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes' - items: - description: Volume represents a named volume in a pod - that may be accessed by any container in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents an - AWS Disk resource that is attached to a kubelet''s - host machine and then exposed to the pod. More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in - the volume that you want to mount. If omitted, - the default is to mount by volume name. Examples: - For volume /dev/sda1, you specify the partition - as "1". Similarly, the volume partition for - /dev/sda is "0" (or you can leave the property - empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will force - the readOnly setting in VolumeMounts. More - info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of the persistent - disk resource in AWS (Amazon EBS volume). - More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure Data - Disk mount on the host and bind mount to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host Caching - mode: None, Read Only, Read Write.' - type: string - diskName: - description: diskName is the Name of the data - disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of data disk - in the blob storage - type: string - fsType: - description: fsType is Filesystem type to mount. - Must be a filesystem type supported by the - host operating system. Ex. "ext4", "xfs", - "ntfs". Implicitly inferred to be "ext4" if - unspecified. - type: string - kind: - description: 'kind expected values are Shared: - multiple blob disks per storage account Dedicated: - single blob disk per storage account Managed: - azure managed data disk (only in managed availability - set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure File - Service mount on the host and bind mount to the - pod. - properties: - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of secret - that contains Azure Storage Account Name and - Key - type: string - shareName: - description: shareName is the azure share Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount on - the host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as the - mounted root, rather than the full Ceph tree, - default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: SecretFile - is the path to key ring for User, default - is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is the - rados user name, default is admin More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters used - to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify the - volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap that - should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: mode - bits used to set permissions on created files - by default. Must be an octal value between - 0000 and 0777 or a decimal value between 0 - and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within - the path are not affected by this setting. - This might be in conflict with other options - that affect the file mode, like fsGroup, and - the result can be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced ConfigMap - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified - which is not present in the ConfigMap, the - volume setup will error unless it is marked - optional. Paths must be relative and may not - contain the '..' path or start with '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 - and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, like - fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May not - be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the CSI driver - that handles this volume. Consult with your - admin for the correct name as registered in - the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", - "ntfs". If not provided, the empty value is - passed to the associated CSI driver which - will determine the default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference - to the secret object containing sensitive - information to pass to the CSI driver to complete - the CSI NodePublishVolume and NodeUnpublishVolume - calls. This field is optional, and may be - empty if no secret is required. If the secret - object contains more than one secret, all - secret references are passed. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults to - false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. - Consult your driver's documentation for supported - values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward API - about the pod that should populate this volume - properties: - defaultMode: - description: 'Optional: mode bits to use on - created files by default. Must be a Optional: - mode bits used to set permissions on created - files by default. Must be an octal value between - 0000 and 0777 or a decimal value between 0 - and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within - the path are not affected by this setting. - This might be in conflict with other options - that affect the file mode, like fsGroup, and - the result can be other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward API - volume file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects a field - of the pod: only annotations, labels, - name and namespace are supported.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits used - to set permissions on this file, must - be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. - YAML accepts both octal and decimal - values, JSON requires decimal values - for mode bits. If not specified, the - volume defaultMode will be used. This - might be in conflict with other options - that affect the file mode, like fsGroup, - and the result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the relative - path name of the file to be created. - Must not be absolute or contain the - ''..'' path. Must be utf-8 encoded. - The first item of the relative path - must not start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource of the - container: only resources limits and - requests (limits.cpu, limits.memory, - requests.cpu and requests.memory) are - currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to - select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary directory - that shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type of - storage medium should back this directory. - The default is "" which means to use the node''s - default medium. Must be an empty string (default) - or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage on memory - medium EmptyDir would be the minimum value - between the SizeLimit specified here and the - sum of memory limits of all containers in - a pod. The default is nil which means that - the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume that - is handled by a cluster storage driver. The volume's - lifecycle is tied to the pod that defines it - - it will be created before the pod starts, and - deleted when the pod is removed. \n Use this if: - a) the volume is only needed while the pod runs, - b) features of normal volumes like restoring from - snapshot or capacity tracking are needed, c) - the storage driver is specified through a storage - class, and d) the storage driver supports dynamic - volume provisioning through a PersistentVolumeClaim - (see EphemeralVolumeSource for more information - on the connection between this volume type and - PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes - that persist for longer than the lifecycle of - an individual pod. \n Use CSI for light-weight - local ephemeral volumes if the CSI driver is meant - to be used that way - see the documentation of - the driver for more information. \n A pod can - use both types of ephemeral volumes and persistent - volumes at the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a stand-alone - PVC to provision the volume. The pod in which - this EphemeralVolumeSource is embedded will - be the owner of the PVC, i.e. the PVC will - be deleted together with the pod. The name - of the PVC will be `-` - where `` is the name from the - `PodSpec.Volumes` array entry. Pod validation - will reject the pod if the concatenated name - is not valid for a PVC (for example, too long). - \n An existing PVC with that name that is - not owned by the pod will *not* be used for - the pod to avoid using an unrelated volume - by mistake. Starting the pod is then blocked - until the unrelated PVC is removed. If such - a pre-created PVC is meant to be used by the - pod, the PVC has to updated with an owner - reference to the pod once the pod exists. - Normally this should not be necessary, but - it may be useful when manually reconstructing - a broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. \n Required, - must not be nil." - properties: - metadata: - description: May contain labels and annotations - that will be copied into the PVC when - creating it. No other fields are allowed - and will be rejected during validation. - type: object - spec: - description: The specification for the PersistentVolumeClaim. - The entire content is copied unchanged - into the PVC that gets created from this - template. The same fields as in a PersistentVolumeClaim - are also valid here. - properties: - accessModes: - description: 'accessModes contains the - desired access modes the volume should - have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be - used to specify either: * An existing - VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create a new - volume based on the contents of the - specified data source. If the AnyVolumeDataSource - feature gate is enabled, this field - will always have the same contents - as the DataSourceRef field.' - properties: - apiGroup: - description: APIGroup is the group - for the resource being referenced. - If APIGroup is not specified, - the specified Kind must be in - the core API group. For any other - third-party types, APIGroup is - required. - type: string - kind: - description: Kind is the type of - resource being referenced - type: string - name: - description: Name is the name of - resource being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may be any - local object from a non-empty API - group (non core object) or a PersistentVolumeClaim - object. When this field is specified, - volume binding will only succeed if - the type of the specified object matches - some installed volume populator or - dynamic provisioner. This field will - replace the functionality of the DataSource - field and as such if both fields are - non-empty, they must have the same - value. For backwards compatibility, - both fields (DataSource and DataSourceRef) - will be set to the same value automatically - if one of them is empty and the other - is non-empty. There are two important - differences between DataSource and - DataSourceRef: * While DataSource - only allows two specific types of - objects, DataSourceRef allows any - non-core object, as well as PersistentVolumeClaim - objects. * While DataSource ignores - disallowed values (dropping them), - DataSourceRef preserves all values, - and generates an error if a disallowed - value is specified. (Beta) Using - this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the group - for the resource being referenced. - If APIGroup is not specified, - the specified Kind must be in - the core API group. For any other - third-party types, APIGroup is - required. - type: string - kind: - description: Kind is the type of - resource being referenced - type: string - name: - description: Name is the name of - resource being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the - minimum resources the volume should - have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed - to specify resource requirements that - are lower than previous value but - must still be higher than capacity - recorded in the status field of the - claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the - maximum amount of compute resources - allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, it - defaults to Limits if that is - explicitly specified, otherwise - to an implementation-defined value. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query - over volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions is - a list of label selector requirements. - The requirements are ANDed. - items: - description: A label selector - requirement is a selector that - contains values, a key, and - an operator that relates the - key and values. - properties: - key: - description: key is the label - key that the selector applies - to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid operators - are In, NotIn, Exists and - DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In or - NotIn, the values array - must be non-empty. If the - operator is Exists or DoesNotExist, - the values array must be - empty. This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map - of {key,value} pairs. A single - {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator is - "In", and the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is the - name of the StorageClass required - by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what - type of volume is required by the - claim. Value of Filesystem is implied - when not included in claim spec. - type: string - volumeName: - description: volumeName is the binding - reference to the PersistentVolume - backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel resource - that is attached to a kubelet's host machine and - then exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem type - to mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. TODO: how do we prevent errors - in the filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target lun - number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: FC target - worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume world - wide identifiers (wwids) Either wwids or combination - of targetWWNs and lun must be set, but not - both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic volume - resource that is provisioned/attached using an - exec based plugin. - properties: - driver: - description: driver is the name of the driver - to use for this volume. - type: string - fsType: - description: fsType is the filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". The default filesystem depends - on FlexVolume script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this field - holds extra command options if any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here will - force the ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the plugin - scripts. This may be empty if no secret object - is specified. If the secret object contains - more than one secret, all secrets are passed - to the plugin scripts.' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker volume - attached to a kubelet's host machine. This depends - on the Flocker control service being running - properties: - datasetName: - description: datasetName is Name of the dataset - stored as metadata -> name on the dataset - for Flocker should be considered as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of the - dataset. This is unique identifier of a Flocker - dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents a GCE - Disk resource that is attached to a kubelet''s - host machine and then exposed to the pod. More - info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type of the - volume that you want to mount. Tip: Ensure - that the filesystem type is supported by the - host operating system. Examples: "ext4", "xfs", - "ntfs". Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - partition: - description: 'partition is the partition in - the volume that you want to mount. If omitted, - the default is to mount by volume name. Examples: - For volume /dev/sda1, you specify the partition - as "1". Similarly, the volume partition for - /dev/sda is "0" (or you can leave the property - empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of the PD - resource in GCE. Used to identify the disk - in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container with a - git repo, mount an EmptyDir into an InitContainer - that clones the repo using git, then mount the - EmptyDir into the Pod''s container.' - properties: - directory: - description: directory is the target directory - name. Must not contain or start with '..'. If - '.' is supplied, the volume directory will - be the git repository. Otherwise, if specified, - the volume will contain the git repository - in the subdirectory with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash for - the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs mount - on the host that shares a pod''s lifetime. More - info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint name - that details Glusterfs topology. More info: - https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume path. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force the Glusterfs - volume to be mounted with read-only permissions. - Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that is - directly exposed to the container. This is generally - used for system agents or other privileged things - that are allowed to see the host machine. Most - containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who can - use host directory mounts and who can/can not - mount host directories as read/write.' - properties: - path: - description: 'path of the directory on the host. - If the path is a symlink, it will follow the - link to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume Defaults - to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk resource - that is attached to a kubelet''s host machine - and then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines whether - support iSCSI Discovery CHAP authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether - support iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom iSCSI - Initiator Name. If initiatorName is specified - with iscsiInterface simultaneously, new iSCSI - interface : will - be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified - Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target Lun - number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target Portal - List. The portal is either an IP or ip_addr:port - if the port is other than default (typically - TCP ports 860 and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret for - iSCSI target and initiator authentication - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target Portal. - The Portal is either an IP or ip_addr:port - if the port is other than default (typically - TCP ports 860 and 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be a DNS_LABEL - and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount on the - host that shares a pod''s lifetime More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by the NFS - server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force the NFS - export to be mounted with read-only permissions. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or IP address - of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this - volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents a PhotonController - persistent disk attached and mounted on kubelets - host machine - properties: - fsType: - description: fsType is the filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx - volume attached and mounted on kubelets host machine - properties: - fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs". Implicitly inferred to be "ext4" if - unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies a - Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one resources - secrets, configmaps, and downward API - properties: - defaultMode: - description: defaultMode are the mode bits used - to set permissions on created files by default. - Must be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON - requires decimal values for mode bits. Directories - within the path are not affected by this setting. - This might be in conflict with other options - that affect the file mode, like fsGroup, and - the result can be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected - along with other supported volume types - properties: - configMap: - description: configMap information about - the configMap data to project - properties: - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced ConfigMap - will be projected into the volume - as a file whose name is the key - and content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the ConfigMap, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be - defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information about - the downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile - represents information to create - the file containing the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version of - the schema the FieldPath - is written in terms of, - defaults to "v1". - type: string - fieldPath: - description: Path of the - field to select in the - specified API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode - bits used to set permissions - on this file, must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: 'Required: Path - is the relative path name - of the file to be created. - Must not be absolute or contain - the ''..'' path. Must be utf-8 - encoded. The first item of - the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container - name: required for volumes, - optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the - output format of the exposed - resources, defaults to - "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about - the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in the Data - field of the referenced Secret will - be projected into the volume as - a file whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, and unlisted - keys will not be present. If a key - is specified which is not present - in the Secret, the volume setup - will error unless it is marked optional. - Paths must be relative and may not - contain the '..' path or start with - '..'. - items: - description: Maps a string key to - a path within a volume. - properties: - key: - description: key is the key - to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 - or a decimal value between - 0 and 511. YAML accepts both - octal and decimal values, - JSON requires decimal values - for mode bits. If not specified, - the volume defaultMode will - be used. This might be in - conflict with other options - that affect the file mode, - like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the - key to. May not be an absolute - path. May not contain the - path element '..'. May not - start with the string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify - whether the Secret or its key must - be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to - project - properties: - audience: - description: audience is the intended - audience of the token. A recipient - of a token must identify itself - with an identifier specified in - the audience of the token, and otherwise - should reject the token. The audience - defaults to the identifier of the - apiserver. - type: string - expirationSeconds: - description: expirationSeconds is - the requested duration of validity - of the service account token. As - the token approaches expiration, - the kubelet volume plugin will proactively - rotate the service account token. - The kubelet will start trying to - rotate the token if the token is - older than 80 percent of its time - to live or if the token is older - than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative - to the mount point of the file to - project the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte mount - on the host that shares a pod's lifetime - properties: - group: - description: group to map volume access to Default - is no group - type: string - readOnly: - description: readOnly here will force the Quobyte - volume to be mounted with read-only permissions. - Defaults to false. - type: boolean - registry: - description: registry represents a single or - multiple Quobyte Registry services specified - as a string as host:port pair (multiple entries - are separated with commas) which acts as the - central registry for volumes - type: string - tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is set - by the plugin - type: string - user: - description: user to map volume access to Defaults - to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block Device - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem type - of the volume that you want to mount. Tip: - Ensure that the filesystem type is supported - by the host operating system. Examples: "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the filesystem - from compromising the machine' - type: string - image: - description: 'image is the rados image name. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key ring - for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection of Ceph - monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. Default - is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force the ReadOnly - setting in VolumeMounts. Defaults to false. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the authentication - secret for RBDUser. If provided overrides - keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. Default - is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO persistent - volume attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Default is "xfs". - type: string - gateway: - description: gateway is the host address of - the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name of - the ScaleIO Protection Domain for the configured - storage. - type: string - readOnly: - description: readOnly Defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the secret - for ScaleIO user and other sensitive information. - If this is not provided, Login operation will - fail. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, default false - type: boolean - storageMode: - description: storageMode indicates whether the - storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO Storage - Pool associated with the protection domain. - type: string - system: - description: system is the name of the storage - system as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of a volume - already created in the ScaleIO system that - is associated with this volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that should - populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: mode - bits used to set permissions on created files - by default. Must be an octal value between - 0000 and 0777 or a decimal value between 0 - and 511. YAML accepts both octal and decimal - values, JSON requires decimal values for mode - bits. Defaults to 0644. Directories within - the path are not affected by this setting. - This might be in conflict with other options - that affect the file mode, like fsGroup, and - the result can be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value - pair in the Data field of the referenced Secret - will be projected into the volume as a file - whose name is the key and content is the value. - If specified, the listed keys will be projected - into the specified paths, and unlisted keys - will not be present. If a key is specified - which is not present in the Secret, the volume - setup will error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. - Must be an octal value between 0000 - and 0777 or a decimal value between - 0 and 511. YAML accepts both octal and - decimal values, JSON requires decimal - values for mode bits. If not specified, - the volume defaultMode will be used. - This might be in conflict with other - options that affect the file mode, like - fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path - of the file to map the key to. May not - be an absolute path. May not contain - the path element '..'. May not start - with the string '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether - the Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the - secret in the pod''s namespace to use. More - info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS volume - attached and mounted on Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem type to - mount. Must be a filesystem type supported - by the host operating system. Ex. "ext4", - "xfs", "ntfs". Implicitly inferred to be "ext4" - if unspecified. - type: string - readOnly: - description: readOnly defaults to false (read/write). - ReadOnly here will force the ReadOnly setting - in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API credentials. If - not specified, default values will be attempted. - properties: - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume names - are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies the scope - of the volume within StorageOS. If no namespace - is specified then the Pod's namespace will - be used. This allows the Kubernetes name - scoping to be mirrored within StorageOS for - tighter integration. Set VolumeName to any - name to override the default behaviour. Set - to "default" if you are not using namespaces - within StorageOS. Namespaces that do not pre-exist - within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere - volume attached and mounted on kubelets host machine - properties: - fsType: - description: fsType is filesystem type to mount. - Must be a filesystem type supported by the - host operating system. Ex. "ext4", "xfs", - "ntfs". Implicitly inferred to be "ext4" if - unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage - Policy Based Management (SPBM) profile ID - associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the storage - Policy Based Management (SPBM) profile name. - type: string - volumePath: - description: volumePath is the path that identifies - vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - resources: - description: Resources is a list of bindings specifying which - actual instances of PipelineResources to use for the resources - the Pipeline has declared it needs. - items: - description: PipelineResourceBinding connects a reference - to an instance of a PipelineResource with a PipelineResource - dependency that the Pipeline has declared - properties: - name: - description: Name is the name of the PipelineResource - in the Pipeline's declaration - type: string - resourceRef: - description: ResourceRef is a reference to the instance - of the actual PipelineResource that should be used - properties: - apiVersion: - description: API version of the referent - type: string - name: - description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' - type: string - type: object - resourceSpec: - description: ResourceSpec is specification of a resource - that should be created and consumed by the task - properties: - description: - description: Description is a user-facing description - of the resource that may be used to populate a - UI. - type: string - params: - items: - description: ResourceParam declares a string value - to use for the parameter called Name, and is - used in the specific context of PipelineResources. - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - secrets: - description: Secrets to fetch to populate some of - resource fields - items: - description: SecretParam indicates which secret - can be used to populate a field of the resource - properties: - fieldName: - type: string - secretKey: - type: string - secretName: - type: string - required: - - fieldName - - secretKey - - secretName - type: object - type: array - x-kubernetes-list-type: atomic - type: - type: string - required: - - params - - type - type: object - type: object - type: array - x-kubernetes-list-type: atomic - serviceAccountName: - type: string - status: - description: Used for cancelling a pipelinerun (and maybe - more later on) - type: string - taskRunSpecs: - description: TaskRunSpecs holds a set of runtime specs - items: - description: PipelineTaskRunSpec can be used to configure - specific specs for a concrete Task - properties: - computeResources: - description: Compute resources to use for this TaskRun - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum amount - of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum amount - of compute resources required. If Requests is - omitted for a container, it defaults to Limits - if that is explicitly specified, otherwise to - an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - metadata: - description: PipelineTaskMetadata contains the labels - or annotations for an EmbeddedTask - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - pipelineTaskName: - type: string - sidecarOverrides: - items: - description: TaskRunSidecarOverride is used to override - the values of a Sidecar in the corresponding Task. - properties: - name: - description: The name of the Sidecar to override. - type: string - resources: - description: The resource requirements to apply - to the Sidecar. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. If - Requests is omitted for a container, it - defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - required: - - name - - resources - type: object - type: array - x-kubernetes-list-type: atomic - stepOverrides: - items: - description: TaskRunStepOverride is used to override - the values of a Step in the corresponding Task. - properties: - name: - description: The name of the Step to override. - type: string - resources: - description: The resource requirements to apply - to the Step. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. If - Requests is omitted for a container, it - defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - required: - - name - - resources - type: object - type: array - x-kubernetes-list-type: atomic - taskPodTemplate: - description: Template holds pod specific configuration - properties: - affinity: - description: If specified, the pod's scheduling - constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling - rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - affinity expressions specified by this - field, but it may choose a node that violates - one or more of the expressions. The node - that is most preferred is the one with - the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a - sum by iterating through the elements - of this field and adding "weight" to the - sum if the node matches the corresponding - matchExpressions; the node(s) with the - highest sum are the most preferred. - items: - description: An empty preferred scheduling - term matches all objects with implicit - weight 0 (i.e. it's a no-op). A null - preferred scheduling term matches no - objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, - associated with the corresponding - weight. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: The label key - that the selector applies - to. - type: string - operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: The label key - that the selector applies - to. - type: string - operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - weight: - description: Weight associated with - matching the corresponding nodeSelectorTerm, - in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to an update), the system may or may - not try to eventually evict the pod from - its node. - properties: - nodeSelectorTerms: - description: Required. A list of node - selector terms. The terms are ORed. - items: - description: A null or empty node - selector term matches no objects. - The requirements of them are ANDed. - The TopologySelectorTerm type implements - a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector - requirements by node's labels. - items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: The label key - that the selector applies - to. - type: string - operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchFields: - description: A list of node selector - requirements by node's fields. - items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: The label key - that the selector applies - to. - type: string - operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. - type: string - values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - type: object - type: array - required: - - nodeSelectorTerms - type: object - type: object - podAffinity: - description: Describes pod affinity scheduling - rules (e.g. co-locate this pod in the same - node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - affinity expressions specified by this - field, but it may choose a node that violates - one or more of the expressions. The node - that is most preferred is the one with - the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a - sum by iterating through the elements - of this field and adding "weight" to the - sum if the node has pods which matches - the corresponding podAffinityTerm; the - node(s) with the highest sum are the most - preferred. - items: - description: The weights of all of the - matched WeightedPodAffinityTerm fields - are added per-node to find the most - preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity - term, associated with the corresponding - weight. - properties: - labelSelector: - description: A label query over - a set of resources, in this - case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over - the set of namespaces that the - term applies to. The term is - applied to the union of the - namespaces selected by this - field and the ones listed in - the namespaces field. null selector - and null or empty namespaces - list means "this pod's namespace". - An empty selector ({}) matches - all namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The - term is applied to the union - of the namespaces listed in - this field and the ones selected - by namespaceSelector. null or - empty namespaces list and null - namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be - co-located (affinity) or not - co-located (anti-affinity) with - the pods matching the labelSelector - in the specified namespaces, - where co-located is defined - as running on a node whose value - of the label with key topologyKey - matches that of any node on - which any of the selected pods - is running. Empty topologyKey - is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with - matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to a pod label update), the system - may or may not try to eventually evict - the pod from its node. When there are - multiple elements, the lists of nodes - corresponding to each podAffinityTerm - are intersected, i.e. all terms must be - satisfied. - items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this - pod should be co-located (affinity) - or not co-located (anti-affinity) with, - where co-located is defined as running - on a node whose value of the label with - key matches that of any - node on which a pod of the set of pods - is running - properties: - labelSelector: - description: A label query over a - set of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling - rules (e.g. avoid putting this pod in the - same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - anti-affinity expressions specified by - this field, but it may choose a node that - violates one or more of the expressions. - The node that is most preferred is the - one with the greatest sum of weights, - i.e. for each node that meets all of the - scheduling requirements (resource request, - requiredDuringScheduling anti-affinity - expressions, etc.), compute a sum by iterating - through the elements of this field and - adding "weight" to the sum if the node - has pods which matches the corresponding - podAffinityTerm; the node(s) with the - highest sum are the most preferred. - items: - description: The weights of all of the - matched WeightedPodAffinityTerm fields - are added per-node to find the most - preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity - term, associated with the corresponding - weight. - properties: - labelSelector: - description: A label query over - a set of resources, in this - case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over - the set of namespaces that the - term applies to. The term is - applied to the union of the - namespaces selected by this - field and the ones listed in - the namespaces field. null selector - and null or empty namespaces - list means "this pod's namespace". - An empty selector ({}) matches - all namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The - term is applied to the union - of the namespaces listed in - this field and the ones selected - by namespaceSelector. null or - empty namespaces list and null - namespaceSelector means "this - pod's namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be - co-located (affinity) or not - co-located (anti-affinity) with - the pods matching the labelSelector - in the specified namespaces, - where co-located is defined - as running on a node whose value - of the label with key topologyKey - matches that of any node on - which any of the selected pods - is running. Empty topologyKey - is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: weight associated with - matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the anti-affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to a pod label update), the system - may or may not try to eventually evict - the pod from its node. When there are - multiple elements, the lists of nodes - corresponding to each podAffinityTerm - are intersected, i.e. all terms must be - satisfied. - items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this - pod should be co-located (affinity) - or not co-located (anti-affinity) with, - where co-located is defined as running - on a node whose value of the label with - key matches that of any - node on which a pod of the set of pods - is running - properties: - labelSelector: - description: A label query over a - set of resources, in this case pods. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. - properties: - key: - description: key is the - label key that the selector - applies to. - type: string - operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. - type: string - values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. - type: object - type: object - namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". - items: - type: string - type: array - topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - type: object - type: object - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates - whether pods running as this service account should - have an API token automatically mounted. - type: boolean - dnsConfig: - description: Specifies the DNS parameters of a pod. - Parameters specified here will be merged to the - generated DNS configuration based on DNSPolicy. - properties: - nameservers: - description: A list of DNS name server IP addresses. - This will be appended to the base nameservers - generated from DNSPolicy. Duplicated nameservers - will be removed. - items: - type: string - type: array - options: - description: A list of DNS resolver options. - This will be merged with the base options - generated from DNSPolicy. Duplicated entries - will be removed. Resolution options given - in Options will override those that appear - in the base DNSPolicy. - items: - description: PodDNSConfigOption defines DNS - resolver options of a pod. - properties: - name: - description: Required. - type: string - value: - type: string - type: object - type: array - searches: - description: A list of DNS search domains for - host-name lookup. This will be appended to - the base search paths generated from DNSPolicy. - Duplicated search paths will be removed. - items: - type: string - type: array - type: object - dnsPolicy: - description: Set DNS policy for the pod. Defaults - to "ClusterFirst". Valid values are 'ClusterFirst', - 'Default' or 'None'. DNS parameters given in DNSConfig - will be merged with the policy selected with DNSPolicy. - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether - information about services should be injected - into pod''s environment variables, matching the - syntax of Docker links. Optional: Defaults to - true.' - type: boolean - env: - description: List of environment variables that - can be provided to the containers belonging to - the pod. - items: - description: EnvVar represents an environment - variable present in a Container. - properties: - name: - description: Name of the environment variable. - Must be a C_IDENTIFIER. - type: string - value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously defined - environment variables in the container and - any service environment variables. If a - variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Defaults to "".' - type: string - valueFrom: - description: Source for the environment variable's - value. Cannot be used if value is not empty. - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - properties: - key: - description: The key to select. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the ConfigMap - or its key must be defined - type: boolean - required: - - key - type: object - fieldRef: - description: 'Selects a field of the pod: - supports metadata.name, metadata.namespace, - `metadata.labels['''']`, `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' - properties: - apiVersion: - description: Version of the schema - the FieldPath is written in terms - of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to - select in the specified API version. - type: string - required: - - fieldPath - type: object - resourceFieldRef: - description: 'Selects a resource of the - container: only resources limits and - requests (limits.cpu, limits.memory, - limits.ephemeral-storage, requests.cpu, - requests.memory and requests.ephemeral-storage) - are currently supported.' - properties: - containerName: - description: 'Container name: required - for volumes, optional for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to - select' - type: string - required: - - resource - type: object - secretKeyRef: - description: Selects a key of a secret - in the pod's namespace - properties: - key: - description: The key of the secret - to select from. Must be a valid - secret key. - type: string - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: Specify whether the Secret - or its key must be defined - type: boolean - required: - - key - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - hostAliases: - description: HostAliases is an optional list of - hosts and IPs that will be injected into the pod's - hosts file if specified. This is only valid for - non-hostNetwork pods. - items: - description: HostAlias holds the mapping between - IP and hostnames that will be injected as an - entry in the pod's hosts file. - properties: - hostnames: - description: Hostnames for the above IP address. - items: - type: string - type: array - ip: - description: IP address of the host file entry. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - hostNetwork: - description: HostNetwork specifies whether the pod - may use the node network namespace - type: boolean - imagePullSecrets: - description: ImagePullSecrets gives the name of - the secret used by the pod to pull the image if - specified - items: - description: LocalObjectReference contains enough - information to let you locate the referenced - object inside the same namespace. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - type: array - x-kubernetes-list-type: atomic - nodeSelector: - additionalProperties: - type: string - description: 'NodeSelector is a selector which must - be true for the pod to fit on a node. Selector - which must match a node''s labels for the pod - to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' - type: object - priorityClassName: - description: If specified, indicates the pod's priority. - "system-node-critical" and "system-cluster-critical" - are two special keywords which indicate the highest - priorities with the former being the highest priority. - Any other name must be defined by creating a PriorityClass - object with that name. If not specified, the pod - priority will be default or zero if there is no - default. - type: string - runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass - object in the node.k8s.io group, which should - be used to run this pod. If no RuntimeClass resource - matches the named class, the pod will not be run. - If unset or empty, the "legacy" RuntimeClass will - be used, which is an implicit class with an empty - definition that uses the default runtime handler. - More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md - This is a beta feature as of Kubernetes v1.14.' - type: string - schedulerName: - description: SchedulerName specifies the scheduler - to be used to dispatch the Pod - type: string - securityContext: - description: 'SecurityContext holds pod-level security - attributes and common container settings. Optional: - Defaults to empty. See type description for default - values of each field.' - properties: - fsGroup: - description: "A special supplemental group that - applies to all containers in a pod. Some volume - types allow the Kubelet to change the ownership - of that volume to be owned by the pod: \n - 1. The owning GID will be the FSGroup 2. The - setgid bit is set (new files created in the - volume will be owned by FSGroup) 3. The permission - bits are OR'd with rw-rw---- \n If unset, - the Kubelet will not modify the ownership - and permissions of any volume. Note that this - field cannot be set when spec.os.name is windows." - format: int64 - type: integer - fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior - of changing ownership and permission of the - volume before being exposed inside Pod. This - field will only apply to volume types which - support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume - types such as: secret, configmaps and emptydir. - Valid values are "OnRootMismatch" and "Always". - If not specified, "Always" is used. Note that - this field cannot be set when spec.os.name - is windows.' - type: string - runAsGroup: - description: The GID to run the entrypoint of - the container process. Uses runtime default - if unset. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence for that container. Note that this - field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: Indicates that the container must - run as a non-root user. If true, the Kubelet - will validate the image at runtime to ensure - that it does not run as UID 0 (root) and fail - to start the container if it does. If unset - or false, no such validation will be performed. - May also be set in SecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence. - type: boolean - runAsUser: - description: The UID to run the entrypoint of - the container process. Defaults to user specified - in image metadata if unspecified. May also - be set in SecurityContext. If set in both - SecurityContext and PodSecurityContext, the - value specified in SecurityContext takes precedence - for that container. Note that this field cannot - be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: The SELinux context to be applied - to all containers. If unspecified, the container - runtime will allocate a random SELinux context - for each container. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence for that container. Note that this - field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label - that applies to the container. - type: string - role: - description: Role is a SELinux role label - that applies to the container. - type: string - type: - description: Type is a SELinux type label - that applies to the container. - type: string - user: - description: User is a SELinux user label - that applies to the container. - type: string - type: object - seccompProfile: - description: The seccomp options to use by the - containers in this pod. Note that this field - cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the node - should be used. The profile must be preconfigured - on the node to work. Must be a descending - path, relative to the kubelet's configured - seccomp profile location. Must only be - set if type is "Localhost". - type: string - type: - description: "type indicates which kind - of seccomp profile will be applied. Valid - options are: \n Localhost - a profile - defined in a file on the node should be - used. RuntimeDefault - the container runtime - default profile should be used. Unconfined - - no profile should be applied." - type: string - required: - - type - type: object - supplementalGroups: - description: A list of groups applied to the - first process run in each container, in addition - to the container's primary GID. If unspecified, - no groups will be added to any container. - Note that this field cannot be set when spec.os.name - is windows. - items: - format: int64 - type: integer - type: array - sysctls: - description: Sysctls hold a list of namespaced - sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail - to launch. Note that this field cannot be - set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter - to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - windowsOptions: - description: The Windows specific settings applied - to all containers. If unspecified, the options - within a container's SecurityContext will - be used. If set in both SecurityContext and - PodSecurityContext, the value specified in - SecurityContext takes precedence. Note that - this field cannot be set when spec.os.name - is linux. - properties: - gmsaCredentialSpec: - description: GMSACredentialSpec is where - the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName - field. - type: string - gmsaCredentialSpecName: - description: GMSACredentialSpecName is the - name of the GMSA credential spec to use. - type: string - hostProcess: - description: HostProcess determines if a - container should be run as a 'Host Process' - container. This field is alpha-level and - will only be honored by components that - enable the WindowsHostProcessContainers - feature flag. Setting this field without - the feature flag will result in errors - when validating the Pod. All of a Pod's - containers must have the same effective - HostProcess value (it is not allowed to - have a mix of HostProcess containers and - non-HostProcess containers). In addition, - if HostProcess is true then HostNetwork - must also be set to true. - type: boolean - runAsUserName: - description: The UserName in Windows to - run the entrypoint of the container process. - Defaults to the user specified in image - metadata if unspecified. May also be set - in PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. - type: string - type: object - type: object - tolerations: - description: If specified, the pod's tolerations. - items: - description: The pod this Toleration is attached - to tolerates any taint that matches the triple - using the matching operator - . - properties: - effect: - description: Effect indicates the taint effect - to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, - PreferNoSchedule and NoExecute. - type: string - key: - description: Key is the taint key that the - toleration applies to. Empty means match - all taint keys. If the key is empty, operator - must be Exists; this combination means to - match all values and all keys. - type: string - operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists - and Equal. Defaults to Equal. Exists is - equivalent to wildcard for value, so that - a pod can tolerate all taints of a particular - category. - type: string - tolerationSeconds: - description: TolerationSeconds represents - the period of time the toleration (which - must be of effect NoExecute, otherwise this - field is ignored) tolerates the taint. By - default, it is not set, which means tolerate - the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict - immediately) by the system. - format: int64 - type: integer - value: - description: Value is the taint value the - toleration matches to. If the operator is - Exists, the value should be empty, otherwise - just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - topologySpreadConstraints: - description: TopologySpreadConstraints controls - how Pods are spread across your cluster among - failure-domains such as regions, zones, nodes, - and other user-defined topology domains. - items: - description: TopologySpreadConstraint specifies - how to spread matching pods among the given - topology. - properties: - labelSelector: - description: LabelSelector is used to find - matching pods. Pods that match this label - selector are counted to determine the number - of pods in their corresponding topology - domain. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The - requirements are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. - type: string - values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. This - array is replaced during a strategic - merge patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - matchLabelKeys: - description: MatchLabelKeys is a set of pod - label keys to select the pods over which - spreading will be calculated. The keys are - used to lookup values from the incoming - pod labels, those key-value labels are ANDed - with labelSelector to select the group of - existing pods over which spreading will - be calculated for the incoming pod. Keys - that don't exist in the incoming pod labels - will be ignored. A null or empty list means - only match against labelSelector. - items: - type: string - type: array - x-kubernetes-list-type: atomic - maxSkew: - description: 'MaxSkew describes the degree - to which pods may be unevenly distributed. - When `whenUnsatisfiable=DoNotSchedule`, - it is the maximum permitted difference between - the number of matching pods in the target - topology and the global minimum. The global - minimum is the minimum number of matching - pods in an eligible domain or zero if the - number of eligible domains is less than - MinDomains. For example, in a 3-zone cluster, - MaxSkew is set to 1, and pods with the same - labelSelector spread as 2/2/1: In this case, - the global minimum is 1. | zone1 | zone2 - | zone3 | | P P | P P | P | - if - MaxSkew is 1, incoming pod can only be scheduled - to zone3 to become 2/2/2; scheduling it - onto zone1(zone2) would make the ActualSkew(3-1) - on zone1(zone2) violate MaxSkew(1). - if - MaxSkew is 2, incoming pod can be scheduled - onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to - topologies that satisfy it. It''s a required - field. Default value is 1 and 0 is not allowed.' - format: int32 - type: integer - minDomains: - description: "MinDomains indicates a minimum - number of eligible domains. When the number - of eligible domains with matching topology - keys is less than minDomains, Pod Topology - Spread treats \"global minimum\" as 0, and - then the calculation of Skew is performed. - And when the number of eligible domains - with matching topology keys equals or greater - than minDomains, this value has no effect - on scheduling. As a result, when the number - of eligible domains is less than minDomains, - scheduler won't schedule more than maxSkew - Pods to those domains. If value is nil, - the constraint behaves as if MinDomains - is equal to 1. Valid values are integers - greater than 0. When value is not nil, WhenUnsatisfiable - must be DoNotSchedule. \n For example, in - a 3-zone cluster, MaxSkew is set to 2, MinDomains - is set to 5 and pods with the same labelSelector - spread as 2/2/2: | zone1 | zone2 | zone3 - | | P P | P P | P P | The number of - domains is less than 5(MinDomains), so \"global - minimum\" is treated as 0. In this situation, - new pod with the same labelSelector cannot - be scheduled, because computed skew will - be 3(3 - 0) if new Pod is scheduled to any - of the three zones, it will violate MaxSkew. - \n This is a beta field and requires the - MinDomainsInPodTopologySpread feature gate - to be enabled (enabled by default)." - format: int32 - type: integer - nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates - how we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. - Options are: - Honor: only nodes matching - nodeAffinity/nodeSelector are included in - the calculations. - Ignore: nodeAffinity/nodeSelector - are ignored. All nodes are included in the - calculations. \n If this value is nil, the - behavior is equivalent to the Honor policy. - This is a alpha-level feature enabled by - the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how - we will treat node taints when calculating - pod topology spread skew. Options are: - - Honor: nodes without taints, along with - tainted nodes for which the incoming pod - has a toleration, are included. - Ignore: - node taints are ignored. All nodes are included. - \n If this value is nil, the behavior is - equivalent to the Ignore policy. This is - a alpha-level feature enabled by the NodeInclusionPolicyInPodTopologySpread - feature flag." - type: string - topologyKey: - description: TopologyKey is the key of node - labels. Nodes that have a label with this - key and identical values are considered - to be in the same topology. We consider - each as a "bucket", and try - to put balanced number of pods into each - bucket. We define a domain as a particular - instance of a topology. Also, we define - an eligible domain as a domain whose nodes - meet the requirements of nodeAffinityPolicy - and nodeTaintsPolicy. e.g. If TopologyKey - is "kubernetes.io/hostname", each Node is - a domain of that topology. And, if TopologyKey - is "topology.kubernetes.io/zone", each zone - is a domain of that topology. It's a required - field. - type: string - whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates - how to deal with a pod if it doesn''t satisfy - the spread constraint. - DoNotSchedule (default) - tells the scheduler not to schedule it. - - ScheduleAnyway tells the scheduler to - schedule the pod in any location, but - giving higher precedence to topologies that - would help reduce the skew. A constraint - is considered "Unsatisfiable" for an incoming - pod if and only if every possible node assignment - for that pod would violate "MaxSkew" on - some topology. For example, in a 3-zone - cluster, MaxSkew is set to 1, and pods with - the same labelSelector spread as 3/1/1: - | zone1 | zone2 | zone3 | | P P P | P | P | - If WhenUnsatisfiable is set to DoNotSchedule, - incoming pod can only be scheduled to zone2(zone3) - to become 3/2/1(3/1/2) as ActualSkew(2-1) - on zone2(zone3) satisfies MaxSkew(1). In - other words, the cluster can still be imbalanced, - but scheduler won''t make it *more* imbalanced. - It''s a required field.' - type: string - required: - - maxSkew - - topologyKey - - whenUnsatisfiable - type: object - type: array - x-kubernetes-list-type: atomic - volumes: - description: 'List of volumes that can be mounted - by containers belonging to the pod. More info: - https://kubernetes.io/docs/concepts/storage/volumes' - items: - description: Volume represents a named volume - in a pod that may be accessed by any container - in the pod. - properties: - awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty).' - format: int32 - type: integer - readOnly: - description: 'readOnly value true will - force the readOnly setting in VolumeMounts. - More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: boolean - volumeID: - description: 'volumeID is unique ID of - the persistent disk resource in AWS - (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' - type: string - required: - - volumeID - type: object - azureDisk: - description: azureDisk represents an Azure - Data Disk mount on the host and bind mount - to the pod. - properties: - cachingMode: - description: 'cachingMode is the Host - Caching mode: None, Read Only, Read - Write.' - type: string - diskName: - description: diskName is the Name of the - data disk in the blob storage - type: string - diskURI: - description: diskURI is the URI of data - disk in the blob storage - type: string - fsType: - description: fsType is Filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - kind: - description: 'kind expected values are - Shared: multiple blob disks per storage - account Dedicated: single blob disk - per storage account Managed: azure - managed data disk (only in managed availability - set). defaults to shared' - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - required: - - diskName - - diskURI - type: object - azureFile: - description: azureFile represents an Azure - File Service mount on the host and bind - mount to the pod. - properties: - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretName: - description: secretName is the name of - secret that contains Azure Storage Account - Name and Key - type: string - shareName: - description: shareName is the azure share - Name - type: string - required: - - secretName - - shareName - type: object - cephfs: - description: cephFS represents a Ceph FS mount - on the host that shares a pod's lifetime - properties: - monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More - info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - items: - type: string - type: array - path: - description: 'path is Optional: Used as - the mounted root, rather than the full - Ceph tree, default is /' - type: string - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: boolean - secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring for - User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is optional: User is - the rados user name, default is admin - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' - type: string - required: - - monitors - type: object - cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - readOnly: - description: 'readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: boolean - secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters - used to connect to OpenStack.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' - type: string - required: - - volumeID - type: object - configMap: - description: configMap represents a configMap - that should populate this volume - properties: - defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be defined - type: boolean - type: object - csi: - description: csi (Container Storage Interface) - represents ephemeral storage that is handled - by certain external CSI drivers (Beta feature). - properties: - driver: - description: driver is the name of the - CSI driver that handles this volume. - Consult with your admin for the correct - name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", - "xfs", "ntfs". If not provided, the - empty value is passed to the associated - CSI driver which will determine the - default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a - reference to the secret object containing - sensitive information to pass to the - CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This - field is optional, and may be empty - if no secret is required. If the secret - object contains more than one secret, - all secret references are passed. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults - to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI - driver. Consult your driver's documentation - for supported values. - type: object - required: - - driver - type: object - downwardAPI: - description: downwardAPI represents downward - API about the pod that should populate this - volume - properties: - defaultMode: - description: 'Optional: mode bits to use - on created files by default. Must be - a Optional: mode bits used to set permissions - on created files by default. Must be - an octal value between 0000 and 0777 - or a decimal value between 0 and 511. - YAML accepts both octal and decimal - values, JSON requires decimal values - for mode bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: Items is a list of downward - API volume file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace are - supported.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file - to be created. Must not be absolute - or contain the ''..'' path. Must - be utf-8 encoded. The first item - of the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - properties: - medium: - description: 'medium represents what type - of storage medium should back this directory. - The default is "" which means to use - the node''s default medium. Must be - an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage - on memory medium EmptyDir would be the - minimum value between the SizeLimit - specified here and the sum of memory - limits of all containers in a pod. The - default is nil which means that the - limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage driver. - The volume's lifecycle is tied to the pod - that defines it - it will be created before - the pod starts, and deleted when the pod - is removed. \n Use this if: a) the volume - is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot - or capacity tracking are needed, c) the - storage driver is specified through a storage - class, and d) the storage driver supports - dynamic volume provisioning through a - PersistentVolumeClaim (see EphemeralVolumeSource - for more information on the connection - between this volume type and PersistentVolumeClaim). - \n Use PersistentVolumeClaim or one of the - vendor-specific APIs for volumes that persist - for longer than the lifecycle of an individual - pod. \n Use CSI for light-weight local ephemeral - volumes if the CSI driver is meant to be - used that way - see the documentation of - the driver for more information. \n A pod - can use both types of ephemeral volumes - and persistent volumes at the same time." - properties: - volumeClaimTemplate: - description: "Will be used to create a - stand-alone PVC to provision the volume. - The pod in which this EphemeralVolumeSource - is embedded will be the owner of the - PVC, i.e. the PVC will be deleted together - with the pod. The name of the PVC will - be `-` where - `` is the name from the - `PodSpec.Volumes` array entry. Pod validation - will reject the pod if the concatenated - name is not valid for a PVC (for example, - too long). \n An existing PVC with that - name that is not owned by the pod will - *not* be used for the pod to avoid using - an unrelated volume by mistake. Starting - the pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod exists. - Normally this should not be necessary, - but it may be useful when manually reconstructing - a broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created. - \n Required, must not be nil." - properties: - metadata: - description: May contain labels and - annotations that will be copied - into the PVC when creating it. No - other fields are allowed and will - be rejected during validation. - type: object - spec: - description: The specification for - the PersistentVolumeClaim. The entire - content is copied unchanged into - the PVC that gets created from this - template. The same fields as in - a PersistentVolumeClaim are also - valid here. - properties: - accessModes: - description: 'accessModes contains - the desired access modes the - volume should have. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create - a new volume based on the contents - of the specified data source. - If the AnyVolumeDataSource feature - gate is enabled, this field - will always have the same contents - as the DataSourceRef field.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may - be any local object from a non-empty - API group (non core object) - or a PersistentVolumeClaim object. - When this field is specified, - volume binding will only succeed - if the type of the specified - object matches some installed - volume populator or dynamic - provisioner. This field will - replace the functionality of - the DataSource field and as - such if both fields are non-empty, - they must have the same value. - For backwards compatibility, - both fields (DataSource and - DataSourceRef) will be set to - the same value automatically - if one of them is empty and - the other is non-empty. There - are two important differences - between DataSource and DataSourceRef: - * While DataSource only allows - two specific types of objects, - DataSourceRef allows any non-core - object, as well as PersistentVolumeClaim - objects. * While DataSource - ignores disallowed values (dropping - them), DataSourceRef preserves - all values, and generates an - error if a disallowed value - is specified. (Beta) Using - this field requires the AnyVolumeDataSource - feature gate to be enabled.' - properties: - apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. - type: string - kind: - description: Kind is the type - of resource being referenced - type: string - name: - description: Name is the name - of resource being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents - the minimum resources the volume - should have. If RecoverVolumeExpansionFailure - feature is enabled users are - allowed to specify resource - requirements that are lower - than previous value but must - still be higher than capacity - recorded in the status field - of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of compute - resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, - it defaults to Limits if - that is explicitly specified, - otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label - query over volumes to consider - for binding. - properties: - matchExpressions: - description: matchExpressions - is a list of label selector - requirements. The requirements - are ANDed. - items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. - properties: - key: - description: key is - the label key that - the selector applies - to. - type: string - operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. - type: string - values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. - type: string - volumeName: - description: volumeName is the - binding reference to the PersistentVolume - backing this claim. - type: string - type: object - required: - - spec - type: object - type: object - fc: - description: fc represents a Fibre Channel - resource that is attached to a kubelet's - host machine and then exposed to the pod. - properties: - fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - lun: - description: 'lun is Optional: FC target - lun number' - format: int32 - type: integer - readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - targetWWNs: - description: 'targetWWNs is Optional: - FC target worldwide names (WWNs)' - items: - type: string - type: array - wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs and - lun must be set, but not both simultaneously.' - items: - type: string - type: array - type: object - flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. - properties: - driver: - description: driver is the name of the - driver to use for this volume. - type: string - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The - default filesystem depends on FlexVolume - script. - type: string - options: - additionalProperties: - type: string - description: 'options is Optional: this - field holds extra command options if - any.' - type: object - readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' - type: boolean - secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the - plugin scripts. This may be empty if - no secret object is specified. If the - secret object contains more than one - secret, all secrets are passed to the - plugin scripts.' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - required: - - driver - type: object - flocker: - description: flocker represents a Flocker - volume attached to a kubelet's host machine. - This depends on the Flocker control service - being running - properties: - datasetName: - description: datasetName is Name of the - dataset stored as metadata -> name on - the dataset for Flocker should be considered - as deprecated - type: string - datasetUUID: - description: datasetUUID is the UUID of - the dataset. This is unique identifier - of a Flocker dataset - type: string - type: object - gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - properties: - fsType: - description: 'fsType is filesystem type - of the volume that you want to mount. - Tip: Ensure that the filesystem type - is supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - format: int32 - type: integer - pdName: - description: 'pdName is unique name of - the PD resource in GCE. Used to identify - the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' - type: boolean - required: - - pdName - type: object - gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container - with a git repo, mount an EmptyDir into - an InitContainer that clones the repo using - git, then mount the EmptyDir into the Pod''s - container.' - properties: - directory: - description: directory is the target directory - name. Must not contain or start with - '..'. If '.' is supplied, the volume - directory will be the git repository. Otherwise, - if specified, the volume will contain - the git repository in the subdirectory - with the given name. - type: string - repository: - description: repository is the URL - type: string - revision: - description: revision is the commit hash - for the specified revision. - type: string - required: - - repository - type: object - glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/glusterfs/README.md' - properties: - endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - path: - description: 'path is the Glusterfs volume - path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: string - readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted with - read-only permissions. Defaults to false. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' - type: boolean - required: - - endpoints - - path - type: object - hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that - is directly exposed to the container. This - is generally used for system agents or other - privileged things that are allowed to see - the host machine. Most containers will NOT - need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who - can use host directory mounts and who can/can - not mount host directories as read/write.' - properties: - path: - description: 'path of the directory on - the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' - type: string - required: - - path - type: object - iscsi: - description: 'iscsi represents an ISCSI Disk - resource that is attached to a kubelet''s - host machine and then exposed to the pod. - More info: https://examples.k8s.io/volumes/iscsi/README.md' - properties: - chapAuthDiscovery: - description: chapAuthDiscovery defines - whether support iSCSI Discovery CHAP - authentication - type: boolean - chapAuthSession: - description: chapAuthSession defines whether - support iSCSI Session CHAP authentication - type: boolean - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - initiatorName: - description: initiatorName is the custom - iSCSI Initiator Name. If initiatorName - is specified with iscsiInterface simultaneously, - new iSCSI interface : will be created for the connection. - type: string - iqn: - description: iqn is the target iSCSI Qualified - Name. - type: string - iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). - type: string - lun: - description: lun represents iSCSI Target - Lun number. - format: int32 - type: integer - portals: - description: portals is the iSCSI Target - Portal List. The portal is either an - IP or ip_addr:port if the port is other - than default (typically TCP ports 860 - and 3260). - items: - type: string - type: array - readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. - type: boolean - secretRef: - description: secretRef is the CHAP Secret - for iSCSI target and initiator authentication - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - targetPortal: - description: targetPortal is iSCSI Target - Portal. The Portal is either an IP or - ip_addr:port if the port is other than - default (typically TCP ports 860 and - 3260). - type: string - required: - - iqn - - lun - - targetPortal - type: object - name: - description: 'name of the volume. Must be - a DNS_LABEL and unique within the pod. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' - type: string - nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - properties: - path: - description: 'path that is exported by - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - readOnly: - description: 'readOnly here will force - the NFS export to be mounted with read-only - permissions. Defaults to false. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: boolean - server: - description: 'server is the hostname or - IP address of the NFS server. More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' - type: string - required: - - path - - server - type: object - persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - claimName: - description: 'claimName is the name of - a PersistentVolumeClaim in the same - namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - photonPersistentDisk: - description: photonPersistentDisk represents - a PhotonController persistent disk attached - and mounted on kubelets host machine - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - pdID: - description: pdID is the ID that identifies - Photon Controller persistent disk - type: string - required: - - pdID - type: object - portworxVolume: - description: portworxVolume represents a portworx - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - volumeID: - description: volumeID uniquely identifies - a Portworx volume - type: string - required: - - volumeID - type: object - projected: - description: projected items for all in one - resources secrets, configmaps, and downward - API - properties: - defaultMode: - description: defaultMode are the mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both - octal and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume - projections - items: - description: Projection that may be - projected along with other supported - volume types - properties: - configMap: - description: configMap information - about the configMap data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - ConfigMap will be projected - into the volume as a file - whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - ConfigMap, the volume setup - will error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional specify - whether the ConfigMap or its - keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information - about the downwardAPI data to - project - properties: - items: - description: Items is a list - of DownwardAPIVolume file - items: - description: DownwardAPIVolumeFile - represents information to - create the file containing - the pod field - properties: - fieldRef: - description: 'Required: - Selects a field of the - pod: only annotations, - labels, name and namespace - are supported.' - properties: - apiVersion: - description: Version - of the schema the - FieldPath is written - in terms of, defaults - to "v1". - type: string - fieldPath: - description: Path - of the field to - select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: - mode bits used to set - permissions on this - file, must be an octal - value between 0000 and - 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and - decimal values, JSON - requires decimal values - for mode bits. If not - specified, the volume - defaultMode will be - used. This might be - in conflict with other - options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: - Path is the relative - path name of the file - to be created. Must - not be absolute or contain - the ''..'' path. Must - be utf-8 encoded. The - first item of the relative - path must not start - with ''..''' - type: string - resourceFieldRef: - description: 'Selects - a resource of the container: - only resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' - properties: - containerName: - description: 'Container - name: required for - volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies - the output format - of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: - resource to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information - about the secret data to project - properties: - items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - Secret will be projected into - the volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - Secret, the volume setup will - error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. - items: - description: Maps a string - key to a path within a volume. - properties: - key: - description: key is the - key to project. - type: string - mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' - format: int32 - type: integer - path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' - type: string - optional: - description: optional field - specify whether the Secret - or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken - is information about the serviceAccountToken - data to project - properties: - audience: - description: audience is the - intended audience of the token. - A recipient of a token must - identify itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. The - audience defaults to the identifier - of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the token - approaches expiration, the - kubelet volume plugin will - proactively rotate the service - account token. The kubelet - will start trying to rotate - the token if the token is - older than 80 percent of its - time to live or if the token - is older than 24 hours.Defaults - to 1 hour and must be at least - 10 minutes. - format: int64 - type: integer - path: - description: path is the path - relative to the mount point - of the file to project the - token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - quobyte: - description: quobyte represents a Quobyte - mount on the host that shares a pod's lifetime - properties: - group: - description: group to map volume access - to Default is no group - type: string - readOnly: - description: readOnly here will force - the Quobyte volume to be mounted with - read-only permissions. Defaults to false. - type: boolean - registry: - description: registry represents a single - or multiple Quobyte Registry services - specified as a string as host:port pair - (multiple entries are separated with - commas) which acts as the central registry - for volumes - type: string - tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is - set by the plugin - type: string - user: - description: user to map volume access - to Defaults to serivceaccount user - type: string - volume: - description: volume is a string that references - an already created Quobyte volume by - name. - type: string - required: - - registry - - volume - type: object - rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' - properties: - fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the - filesystem from compromising the machine' - type: string - image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - keyring: - description: 'keyring is the path to key - ring for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - items: - type: string - type: array - pool: - description: 'pool is the rados pool name. - Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: boolean - secretRef: - description: 'secretRef is name of the - authentication secret for RBDUser. If - provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - user: - description: 'user is the rados user name. - Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' - type: string - required: - - image - - monitors - type: object - scaleIO: - description: scaleIO represents a ScaleIO - persistent volume attached and mounted on - Kubernetes nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default - is "xfs". - type: string - gateway: - description: gateway is the host address - of the ScaleIO API Gateway. - type: string - protectionDomain: - description: protectionDomain is the name - of the ScaleIO Protection Domain for - the configured storage. - type: string - readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef references to the - secret for ScaleIO user and other sensitive - information. If this is not provided, - Login operation will fail. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - sslEnabled: - description: sslEnabled Flag enable/disable - SSL communication with Gateway, default - false - type: boolean - storageMode: - description: storageMode indicates whether - the storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. - type: string - storagePool: - description: storagePool is the ScaleIO - Storage Pool associated with the protection - domain. - type: string - system: - description: system is the name of the - storage system as configured in ScaleIO. - type: string - volumeName: - description: volumeName is the name of - a volume already created in the ScaleIO - system that is associated with this - volume source. - type: string - required: - - gateway - - secretRef - - system - type: object - secret: - description: 'secret represents a secret that - should populate this volume. More info: - https://kubernetes.io/docs/concepts/storage/volumes#secret' - properties: - defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether - the Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of - the secret in the pod''s namespace to - use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - storageos: - description: storageOS represents a StorageOS - volume attached and mounted on Kubernetes - nodes. - properties: - fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force - the ReadOnly setting in VolumeMounts. - type: boolean - secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API - credentials. If not specified, default - values will be attempted. - properties: - name: - description: 'Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume - names are only unique within a namespace. - type: string - volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the Pod's - namespace will be used. This allows - the Kubernetes name scoping to be mirrored - within StorageOS for tighter integration. - Set VolumeName to any name to override - the default behaviour. Set to "default" - if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist - within StorageOS will be created. - type: string - type: object - vsphereVolume: - description: vsphereVolume represents a vSphere - volume attached and mounted on kubelets - host machine - properties: - fsType: - description: fsType is filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - type: string - storagePolicyID: - description: storagePolicyID is the storage - Policy Based Management (SPBM) profile - ID associated with the StoragePolicyName. - type: string - storagePolicyName: - description: storagePolicyName is the - storage Policy Based Management (SPBM) - profile name. - type: string - volumePath: - description: volumePath is the path that - identifies vSphere volume vmdk - type: string - required: - - volumePath - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - taskServiceAccountName: - type: string - type: object - type: array - x-kubernetes-list-type: atomic - timeout: - description: 'Timeout Deprecated: use pipelineRunSpec.Timeouts.Pipeline - instead Time after which the Pipeline times out. Defaults - to never. Refer to Go''s ParseDuration documentation for - expected format: https://golang.org/pkg/time/#ParseDuration' - type: string - timeouts: - description: Time after which the Pipeline times out. Currently - three keys are accepted in the map pipeline, tasks and finally - with Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally - properties: - finally: - description: Finally sets the maximum allowed duration - of this pipeline's finally - type: string - pipeline: - description: Pipeline sets the maximum allowed duration - for execution of the entire pipeline. The sum of individual - timeouts for tasks and finally must not exceed this - value. - type: string - tasks: - description: Tasks sets the maximum allowed duration of - this pipeline's tasks - type: string - type: object - workspaces: - description: Workspaces holds a set of workspace bindings - that must match names with those declared in the pipeline. - items: - description: WorkspaceBinding maps a Task's declared workspace - to a Volume. - properties: - configMap: - description: ConfigMap represents a configMap that should - populate this workspace. - properties: - defaultMode: - description: 'defaultMode is optional: mode bits - used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. Directories - within the path are not affected by this setting. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - items: - description: items if unspecified, each key-value - pair in the Data field of the referenced ConfigMap - will be projected into the volume as a file whose - name is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. - If a key is specified which is not present in - the ConfigMap, the volume setup will error unless - it is marked optional. Paths must be relative - and may not contain the '..' path or start with - '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. Must - be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON - requires decimal values for mode bits. If - not specified, the volume defaultMode will - be used. This might be in conflict with - other options that affect the file mode, - like fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path of - the file to map the key to. May not be an - absolute path. May not contain the path - element '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, - uid?' - type: string - optional: - description: optional specify whether the ConfigMap - or its keys must be defined - type: boolean - type: object - csi: - description: CSI (Container Storage Interface) represents - ephemeral storage that is handled by certain external - CSI drivers. - properties: - driver: - description: driver is the name of the CSI driver - that handles this volume. Consult with your admin - for the correct name as registered in the cluster. - type: string - fsType: - description: fsType to mount. Ex. "ext4", "xfs", - "ntfs". If not provided, the empty value is passed - to the associated CSI driver which will determine - the default filesystem to apply. - type: string - nodePublishSecretRef: - description: nodePublishSecretRef is a reference - to the secret object containing sensitive information - to pass to the CSI driver to complete the CSI - NodePublishVolume and NodeUnpublishVolume calls. - This field is optional, and may be empty if no - secret is required. If the secret object contains - more than one secret, all secret references are - passed. - properties: - name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - type: object - readOnly: - description: readOnly specifies a read-only configuration - for the volume. Defaults to false (read/write). - type: boolean - volumeAttributes: - additionalProperties: - type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI driver. - Consult your driver's documentation for supported - values. - type: object - required: - - driver - type: object - emptyDir: - description: 'EmptyDir represents a temporary directory - that shares a Task''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir - Either this OR PersistentVolumeClaim can be used.' - properties: - medium: - description: 'medium represents what type of storage - medium should back this directory. The default - is "" which means to use the node''s default medium. - Must be an empty string (default) or Memory. More - info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' - type: string - sizeLimit: - anyOf: - - type: integer - - type: string - description: 'sizeLimit is the total amount of local - storage required for this EmptyDir volume. The - size limit is also applicable for memory medium. - The maximum usage on memory medium EmptyDir would - be the minimum value between the SizeLimit specified - here and the sum of memory limits of all containers - in a pod. The default is nil which means that - the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - type: object - name: - description: Name is the name of the workspace populated - by the volume. - type: string - persistentVolumeClaim: - description: PersistentVolumeClaimVolumeSource represents - a reference to a PersistentVolumeClaim in the same - namespace. Either this OR EmptyDir can be used. - properties: - claimName: - description: 'claimName is the name of a PersistentVolumeClaim - in the same namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - type: string - readOnly: - description: readOnly Will force the ReadOnly setting - in VolumeMounts. Default false. - type: boolean - required: - - claimName - type: object - projected: - description: Projected represents a projected volume - that should populate this workspace. - properties: - defaultMode: - description: defaultMode are the mode bits used - to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Directories within the path - are not affected by this setting. This might be - in conflict with other options that affect the - file mode, like fsGroup, and the result can be - other mode bits set. - format: int32 - type: integer - sources: - description: sources is the list of volume projections - items: - description: Projection that may be projected - along with other supported volume types - properties: - configMap: - description: configMap information about the - configMap data to project - properties: - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional specify whether - the ConfigMap or its keys must be defined - type: boolean - type: object - downwardAPI: - description: downwardAPI information about - the downwardAPI data to project - properties: - items: - description: Items is a list of DownwardAPIVolume - file - items: - description: DownwardAPIVolumeFile represents - information to create the file containing - the pod field - properties: - fieldRef: - description: 'Required: Selects - a field of the pod: only annotations, - labels, name and namespace are - supported.' - properties: - apiVersion: - description: Version of the - schema the FieldPath is written - in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field - to select in the specified - API version. - type: string - required: - - fieldPath - type: object - mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' - format: int32 - type: integer - path: - description: 'Required: Path is the - relative path name of the file - to be created. Must not be absolute - or contain the ''..'' path. Must - be utf-8 encoded. The first item - of the relative path must not - start with ''..''' - type: string - resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' - properties: - containerName: - description: 'Container name: - required for volumes, optional - for env vars' - type: string - divisor: - anyOf: - - type: integer - - type: string - description: Specifies the output - format of the exposed resources, - defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource - to select' - type: string - required: - - resource - type: object - required: - - path - type: object - type: array - type: object - secret: - description: secret information about the - secret data to project - properties: - items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. - items: - description: Maps a string key to a - path within a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' - format: int32 - type: integer - path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' - type: string - optional: - description: optional field specify whether - the Secret or its key must be defined - type: boolean - type: object - serviceAccountToken: - description: serviceAccountToken is information - about the serviceAccountToken data to project - properties: - audience: - description: audience is the intended - audience of the token. A recipient of - a token must identify itself with an - identifier specified in the audience - of the token, and otherwise should reject - the token. The audience defaults to - the identifier of the apiserver. - type: string - expirationSeconds: - description: expirationSeconds is the - requested duration of validity of the - service account token. As the token - approaches expiration, the kubelet volume - plugin will proactively rotate the service - account token. The kubelet will start - trying to rotate the token if the token - is older than 80 percent of its time - to live or if the token is older than - 24 hours.Defaults to 1 hour and must - be at least 10 minutes. - format: int64 - type: integer - path: - description: path is the path relative - to the mount point of the file to project - the token into. - type: string - required: - - path - type: object - type: object - type: array - type: object - secret: - description: Secret represents a secret that should - populate this workspace. - properties: - defaultMode: - description: 'defaultMode is Optional: mode bits - used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML accepts - both octal and decimal values, JSON requires decimal - values for mode bits. Defaults to 0644. Directories - within the path are not affected by this setting. - This might be in conflict with other options that - affect the file mode, like fsGroup, and the result - can be other mode bits set.' - format: int32 - type: integer - items: - description: items If unspecified, each key-value - pair in the Data field of the referenced Secret - will be projected into the volume as a file whose - name is the key and content is the value. If specified, - the listed keys will be projected into the specified - paths, and unlisted keys will not be present. - If a key is specified which is not present in - the Secret, the volume setup will error unless - it is marked optional. Paths must be relative - and may not contain the '..' path or start with - '..'. - items: - description: Maps a string key to a path within - a volume. - properties: - key: - description: key is the key to project. - type: string - mode: - description: 'mode is Optional: mode bits - used to set permissions on this file. Must - be an octal value between 0000 and 0777 - or a decimal value between 0 and 511. YAML - accepts both octal and decimal values, JSON - requires decimal values for mode bits. If - not specified, the volume defaultMode will - be used. This might be in conflict with - other options that affect the file mode, - like fsGroup, and the result can be other - mode bits set.' - format: int32 - type: integer - path: - description: path is the relative path of - the file to map the key to. May not be an - absolute path. May not contain the path - element '..'. May not start with the string - '..'. - type: string - required: - - key - - path - type: object - type: array - optional: - description: optional field specify whether the - Secret or its keys must be defined - type: boolean - secretName: - description: 'secretName is the name of the secret - in the pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' - type: string - type: object - subPath: - description: SubPath is optionally a directory on the - volume which should be used for this binding (i.e. - the volume will be mounted at this sub directory). - type: string - volumeClaimTemplate: - description: VolumeClaimTemplate is a template for a - claim that will be created in the same namespace. - The PipelineRun controller is responsible for creating - a unique claim for each instance of PipelineRun. - properties: - apiVersion: - description: 'APIVersion defines the versioned schema - of this representation of an object. Servers should - convert recognized schemas to the latest internal - value, and may reject unrecognized values. More - info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing - the REST resource this object represents. Servers - may infer this from the endpoint the client submits - requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - description: 'Standard object''s metadata. More - info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata' - type: object - spec: - description: 'spec defines the desired characteristics - of a volume requested by a pod author. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - accessModes: - description: 'accessModes contains the desired - access modes the volume should have. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - dataSource: - description: 'dataSource field can be used to - specify either: * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) - * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external controller - can support the specified data source, it - will create a new volume based on the contents - of the specified data source. If the AnyVolumeDataSource - feature gate is enabled, this field will always - have the same contents as the DataSourceRef - field.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - dataSourceRef: - description: 'dataSourceRef specifies the object - from which to populate the volume with data, - if a non-empty volume is desired. This may - be any local object from a non-empty API group - (non core object) or a PersistentVolumeClaim - object. When this field is specified, volume - binding will only succeed if the type of the - specified object matches some installed volume - populator or dynamic provisioner. This field - will replace the functionality of the DataSource - field and as such if both fields are non-empty, - they must have the same value. For backwards - compatibility, both fields (DataSource and - DataSourceRef) will be set to the same value - automatically if one of them is empty and - the other is non-empty. There are two important - differences between DataSource and DataSourceRef: - * While DataSource only allows two specific - types of objects, DataSourceRef allows any - non-core object, as well as PersistentVolumeClaim - objects. * While DataSource ignores disallowed - values (dropping them), DataSourceRef preserves - all values, and generates an error if a disallowed - value is specified. (Beta) Using this field - requires the AnyVolumeDataSource feature gate - to be enabled.' - properties: - apiGroup: - description: APIGroup is the group for the - resource being referenced. If APIGroup - is not specified, the specified Kind must - be in the core API group. For any other - third-party types, APIGroup is required. - type: string - kind: - description: Kind is the type of resource - being referenced - type: string - name: - description: Name is the name of resource - being referenced - type: string - required: - - kind - - name - type: object - resources: - description: 'resources represents the minimum - resources the volume should have. If RecoverVolumeExpansionFailure - feature is enabled users are allowed to specify - resource requirements that are lower than - previous value but must still be higher than - capacity recorded in the status field of the - claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' - type: object - type: object - selector: - description: selector is a label query over - volumes to consider for binding. - properties: - matchExpressions: - description: matchExpressions is a list - of label selector requirements. The requirements - are ANDed. - items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. - properties: - key: - description: key is the label key - that the selector applies to. - type: string - operator: - description: operator represents a - key's relationship to a set of values. - Valid operators are In, NotIn, Exists - and DoesNotExist. - type: string - values: - description: values is an array of - string values. If the operator is - In or NotIn, the values array must - be non-empty. If the operator is - Exists or DoesNotExist, the values - array must be empty. This array - is replaced during a strategic merge - patch. - items: - type: string - type: array - required: - - key - - operator - type: object - type: array - matchLabels: - additionalProperties: - type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. - type: object - type: object - storageClassName: - description: 'storageClassName is the name of - the StorageClass required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' - type: string - volumeMode: - description: volumeMode defines what type of - volume is required by the claim. Value of - Filesystem is implied when not included in - claim spec. - type: string - volumeName: - description: volumeName is the binding reference - to the PersistentVolume backing this claim. - type: string - type: object - status: - description: 'status represents the current information/status - of a persistent volume claim. Read-only. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' - properties: - accessModes: - description: 'accessModes contains the actual - access modes the volume backing the PVC has. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' - items: - type: string - type: array - allocatedResources: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: allocatedResources is the storage - resource within AllocatedResources tracks - the capacity allocated to a PVC. It may be - larger than the actual capacity when a volume - expansion operation is requested. For storage - quota, the larger value from allocatedResources - and PVC.spec.resources is used. If allocatedResources - is not set, PVC.spec.resources alone is used - for quota calculation. If a volume expansion - capacity request is lowered, allocatedResources - is only lowered if there are no expansion - operations in progress and if the actual volume - capacity is equal or lower than the requested - capacity. This is an alpha field and requires - enabling RecoverVolumeExpansionFailure feature. - type: object - capacity: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: capacity represents the actual - resources of the underlying volume. - type: object - conditions: - description: conditions is the current Condition - of persistent volume claim. If underlying - persistent volume is being resized then the - Condition will be set to 'ResizeStarted'. - items: - description: PersistentVolumeClaimCondition - contails details about state of pvc - properties: - lastProbeTime: - description: lastProbeTime is the time - we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: lastTransitionTime is the - time the condition transitioned from - one status to another. - format: date-time - type: string - message: - description: message is the human-readable - message indicating details about last - transition. - type: string - reason: - description: reason is a unique, this - should be a short, machine understandable - string that gives the reason for condition's - last transition. If it reports "ResizeStarted" - that means the underlying persistent - volume is being resized. - type: string - status: - type: string - type: - description: PersistentVolumeClaimConditionType - is a valid value of PersistentVolumeClaimCondition.Type - type: string - required: - - status - - type - type: object - type: array - phase: - description: phase represents the current phase - of PersistentVolumeClaim. - type: string - resizeStatus: - description: resizeStatus stores status of resize - operation. ResizeStatus is not set by default - but when expansion is complete resizeStatus - is set to empty string by resize controller - or kubelet. This is an alpha field and requires - enabling RecoverVolumeExpansionFailure feature. - type: string - type: object - type: object - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - type: - description: Type is the type of job and informs how the jobs is triggered - enum: - - presubmit - - postsubmit - - periodic - - batch - type: string - type: object - status: - anyOf: - - not: - properties: - state: - enum: - - "success" - - "failure" - - "error" - - required: - - completionTime - description: ProwJobStatus provides runtime metadata, such as when it - finished, whether it is running, etc. - properties: - build_id: - description: BuildID is the build identifier vended either by tot - or the snowflake library for this job and used as an identifier - for grouping artifacts in GCS for views in TestGrid and Gubernator. - Idenitifiers vended by tot are monotonically increasing whereas - identifiers vended by the snowflake library are not. - type: string - completionTime: - description: CompletionTime is the timestamp for when the job goes - to a final state - format: date-time - type: string - description: - type: string - jenkins_build_id: - description: JenkinsBuildID applies only to ProwJobs fulfilled by - the jenkins-operator. This field is the build identifier that Jenkins - gave to the build for this ProwJob. - type: string - pendingTime: - description: PendingTime is the timestamp for when the job moved from - triggered to pending - format: date-time - type: string - pod_name: - description: PodName applies only to ProwJobs fulfilled by plank. - This field should always be the same as the ProwJob.ObjectMeta.Name - field. - type: string - prev_report_states: - additionalProperties: - description: ProwJobState specifies whether the job is running - type: string - description: PrevReportStates stores the previous reported prowjob - state per reporter So crier won't make duplicated report attempt - type: object - startTime: - description: StartTime is equal to the creation time of the ProwJob - format: date-time - type: string - state: - description: ProwJobState specifies whether the job is running - enum: - - scheduling - - triggered - - pending - - success - - failure - - aborted - - error - type: string - url: - type: string - type: object - type: object - served: true - storage: true - subresources: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/config/prow/cluster/pushgateway_deployment.yaml b/config/prow/cluster/pushgateway_deployment.yaml deleted file mode 100644 index ee90f33cfad5..000000000000 --- a/config/prow/cluster/pushgateway_deployment.yaml +++ /dev/null @@ -1,113 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: pushgateway - labels: - app: pushgateway -spec: - replicas: 0 - selector: - matchLabels: - app: pushgateway - template: - metadata: - labels: - app: pushgateway - spec: - containers: - - name: pushgateway - image: prom/pushgateway:v0.4.0 - ports: - - name: http - containerPort: 9091 ---- -apiVersion: v1 -kind: Service -metadata: - namespace: default - name: pushgateway - labels: - app: pushgateway -spec: - ports: - - name: pushgateway - port: 80 - targetPort: http - type: NodePort - selector: - app: pushgateway ---- -kind: ConfigMap -apiVersion: v1 -metadata: - namespace: default - name: pushgateway-proxy-config -data: - nginx.conf: |- - user www-data; - worker_processes 4; - pid /run/nginx.pid; - error_log /dev/stdout; - events { - worker_connections 1024; - } - http { - access_log /dev/stdout; - server { - listen 0.0.0.0:8081; - location / { - limit_except GET { - deny all; - } - proxy_pass http://pushgateway; - } - } - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: pushgateway-proxy - labels: - app: pushgateway-proxy -spec: - replicas: 0 - selector: - matchLabels: - app: pushgateway-proxy - template: - metadata: - labels: - app: pushgateway-proxy - spec: - containers: - - name: nginx - ports: - - name: http - containerPort: 8081 - image: nginx:1 - volumeMounts: - - name: config-volume - mountPath: /etc/nginx/ - volumes: - - name: config-volume - configMap: - name: pushgateway-proxy-config ---- -apiVersion: v1 -kind: Service -metadata: - namespace: default - name: pushgateway-external - labels: - app: pushgateway-external -spec: - ports: - - name: pushgateway-external - port: 80 - targetPort: http - type: NodePort - selector: - app: pushgateway-proxy diff --git a/config/prow/cluster/sinker_deployment.yaml b/config/prow/cluster/sinker_deployment.yaml deleted file mode 100644 index 5e6c5b84928b..000000000000 --- a/config/prow/cluster/sinker_deployment.yaml +++ /dev/null @@ -1,108 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: sinker - labels: - app: sinker -spec: - replicas: 0 - selector: - matchLabels: - app: sinker - template: - metadata: - labels: - app: sinker - spec: - serviceAccountName: sinker - containers: - - name: sinker - args: - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - - --dry-run=false - image: us-docker.pkg.dev/k8s-infra-prow/images/sinker:v20240802-66b115076 - env: - # Use KUBECONFIG envvar rather than --kubeconfig flag in order to provide multiple configs to merge. - - name: KUBECONFIG - value: "/etc/kubeconfig/config:/etc/kubeconfig-build-test-infra-trusted/kubeconfig:/etc/kubeconfig-build-k8s-prow-builds/kubeconfig:/etc/kubeconfig-build-rules-k8s/kubeconfig:/etc/kubeconfig-eks-prow-build-cluster/kubeconfig::/etc/kubeconfig-k8s-infra-kops-prow-build/kubeconfig" - # AWS_ variables needed to assume role to access the prow-build-cluster EKS cluster. - - name: AWS_ROLE_ARN - value: arn:aws:iam::468814281478:role/Prow-EKS-Admin - - name: AWS_WEB_IDENTITY_TOKEN_FILE - value: /var/run/secrets/aws-iam-token/serviceaccount/token - - name: AWS_REGION - value: us-east-2 - ports: - - name: metrics - containerPort: 9090 - volumeMounts: - - mountPath: /etc/kubeconfig - name: kubeconfig - readOnly: true - - mountPath: /etc/kubeconfig-build-test-infra-trusted - name: kubeconfig-build-test-infra-trusted - readOnly: true - - mountPath: /etc/kubeconfig-build-k8s-prow-builds - name: kubeconfig-build-k8s-prow-builds - readOnly: true - - mountPath: /etc/kubeconfig-build-rules-k8s - name: kubeconfig-build-rules-k8s - readOnly: true - - mountPath: /etc/kubeconfig-eks-prow-build-cluster - name: kubeconfig-eks-prow-build-cluster - readOnly: true - - mountPath: /etc/kubeconfig-k8s-infra-kops-prow-build - name: kubeconfig-k8s-infra-kops-prow-build - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - mountPath: /var/run/secrets/aws-iam-token/serviceaccount - readOnly: true - volumes: - - name: kubeconfig - secret: - defaultMode: 420 - secretName: kubeconfig - - name: kubeconfig-build-test-infra-trusted - secret: - defaultMode: 420 - secretName: kubeconfig-build-test-infra-trusted - - name: kubeconfig-build-k8s-prow-builds - secret: - defaultMode: 420 - secretName: kubeconfig-build-k8s-prow-builds - - name: kubeconfig-build-rules-k8s - secret: - defaultMode: 420 - secretName: kubeconfig-build-rules-k8s - - name: kubeconfig-eks-prow-build-cluster - secret: - defaultMode: 420 - secretName: kubeconfig-eks-prow-build-cluster - - name: kubeconfig-k8s-infra-kops-prow-build - secret: - defaultMode: 420 - secretName: kubeconfig-k8s-infra-kops-prow-build - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - # AWS IAM token needed to assume role to access the prow-build-cluster EKS cluster. - - name: aws-iam-token - projected: - defaultMode: 420 - sources: - - serviceAccountToken: - audience: sts.amazonaws.com - expirationSeconds: 86400 - path: token diff --git a/config/prow/cluster/sinker_rbac.yaml b/config/prow/cluster/sinker_rbac.yaml deleted file mode 100644 index 70eb9b52bc67..000000000000 --- a/config/prow/cluster/sinker_rbac.yaml +++ /dev/null @@ -1,96 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: "sinker" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "sinker" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - delete - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" - namespace: default diff --git a/config/prow/cluster/sinker_service.yaml b/config/prow/cluster/sinker_service.yaml deleted file mode 100644 index 275851d7ac3f..000000000000 --- a/config/prow/cluster/sinker_service.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2019 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - labels: - app: sinker - namespace: default - name: sinker -spec: - ports: - - name: metrics - port: 9090 - protocol: TCP - selector: - app: sinker diff --git a/config/prow/cluster/starter/starter-azure.yaml b/config/prow/cluster/starter/starter-azure.yaml deleted file mode 100644 index 158b9e24fa61..000000000000 --- a/config/prow/cluster/starter/starter-azure.yaml +++ /dev/null @@ -1,1357 +0,0 @@ -# This file contains Kubernetes YAML files for the most important prow -# components. Don't edit resources in this file. Instead, pull them out into -# their own files. ---- -apiVersion: v1 -kind: Namespace -metadata: - name: prow ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: plugins -data: - plugins.yaml: | - plugins: - $GITHUB_ORG: - plugins: - - approve - - assign - - blunderbuss - - cat - - dog - - help - - heart - - hold - - label - - lgtm - - trigger - - verify-owners - - wip - - yuks ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: github-token -stringData: - cert: $GITHUB_TOKEN - appid: "$GITHUB_APP_ID" ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: hmac-token -stringData: - # Generate via `openssl rand -hex 20`. This is the secret used in the GitHub webhook configuration - hmac: $HMAC_TOKEN ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: minio-root-creds -stringData: - user: "$AZURE_STORAGE_ACCOUNT_USER" - password: "$AZURE_STORAGE_ACCOUNT_PASSWORD" ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: config -data: - config.yaml: | - prowjob_namespace: prow - pod_namespace: test-pods - - in_repo_config: - enabled: - "*": true - - deck: - spyglass: - lenses: - - lens: - name: metadata - required_files: - - ^(?:started|finished)\.json$ - optional_files: - - ^(?:podinfo|prowjob)\.json$ - - lens: - config: - name: buildlog - required_files: - - build-log.txt - - lens: - name: junit - required_files: - - .*/junit.*\.xml - - lens: - name: podinfo - required_files: - - podinfo.json - - plank: - job_url_prefix_config: - "*": https://$PROW_HOST/view/ - report_templates: - '*': >- - [Full PR test history](https://$PROW_HOST/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). - [Your PR dashboard](https://$PROW_HOST/pr?query=is:pr+state:open+author:{{with - index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). - default_decoration_config_entries: - - config: - gcs_configuration: - bucket: s3://prow-logs - path_strategy: explicit - github_api_endpoints: - - http://ghproxy - - https://api.github.com - github_app_id: "$GITHUB_APP_ID" - github_app_private_key_secret: - name: github-token - key: cert - s3_credentials_secret: s3-credentials - utility_images: - clonerefs: us-docker.pkg.dev/k8s-infra-prow/images/clonerefs:v20240802-66b115076 - entrypoint: us-docker.pkg.dev/k8s-infra-prow/images/entrypoint:v20240802-66b115076 - initupload: us-docker.pkg.dev/k8s-infra-prow/images/initupload:v20240802-66b115076 - sidecar: us-docker.pkg.dev/k8s-infra-prow/images/sidecar:v20240802-66b115076 - - tide: - queries: - - labels: - - lgtm - - approved - missingLabels: - - needs-rebase - - do-not-merge/hold - - do-not-merge/work-in-progress - - do-not-merge/invalid-owners-file - orgs: - - $GITHUB_ORG - - decorate_all_jobs: true - periodics: - - interval: 1m - agent: kubernetes - name: echo-test - spec: - containers: - - image: alpine - command: ["/bin/date"] ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: hook - labels: - app: hook -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: hook - template: - metadata: - labels: - app: hook - spec: - serviceAccountName: "hook" - terminationGracePeriodSeconds: 180 - containers: - - name: hook - image: us-docker.pkg.dev/k8s-infra-prow/images/hook:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: hmac - secret: - secretName: hmac-token - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: hook -spec: - selector: - app: hook - ports: - - port: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: sinker - labels: - app: sinker -spec: - selector: - matchLabels: - app: sinker - replicas: 1 - template: - metadata: - labels: - app: sinker - spec: - serviceAccountName: "sinker" - containers: - - name: sinker - image: us-docker.pkg.dev/k8s-infra-prow/images/sinker:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --dry-run=false - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: deck - labels: - app: deck -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: deck - template: - metadata: - labels: - app: deck - spec: - serviceAccountName: "deck" - terminationGracePeriodSeconds: 30 - containers: - - name: deck - image: us-docker.pkg.dev/k8s-infra-prow/images/deck:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --plugin-config=/etc/plugins/plugins.yaml - - --tide-url=http://tide/ - - --hook-url=http://hook:8888/plugin-help - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --spyglass=true - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: deck -spec: - selector: - app: deck - ports: - - port: 80 - targetPort: 8080 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: horologium - labels: - app: horologium -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: horologium - template: - metadata: - labels: - app: horologium - spec: - serviceAccountName: "horologium" - terminationGracePeriodSeconds: 30 - containers: - - name: horologium - image: us-docker.pkg.dev/k8s-infra-prow/images/horologium:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: tide - labels: - app: tide -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: tide - template: - metadata: - labels: - app: tide - spec: - serviceAccountName: "tide" - containers: - - name: tide - image: us-docker.pkg.dev/k8s-infra-prow/images/tide:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://tide/tide-status - - --history-uri=s3://tide/tide-history.json - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: tide -spec: - selector: - app: tide - ports: - - port: 80 - targetPort: 8888 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: prow - name: prow - annotations: - # Change this to your issuer when using cert-manager. Does - # nothing when not using cert-manager. - cert-manager.io/cluster-issuer: letsencrypt-staging -spec: - defaultBackend: - # specify the default backend for `ingress-gce` (https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#default_backend) - service: - name: deck - port: - number: 80 - rules: - - host: $PROW_HOST - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: Prefix - backend: - service: - name: hook - port: - number: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: statusreconciler - namespace: prow - labels: - app: statusreconciler -spec: - replicas: 1 - selector: - matchLabels: - app: statusreconciler - template: - metadata: - labels: - app: statusreconciler - spec: - serviceAccountName: statusreconciler - terminationGracePeriodSeconds: 180 - containers: - - name: statusreconciler - image: us-docker.pkg.dev/k8s-infra-prow/images/status-reconciler:v20240802-66b115076 - args: - - --dry-run=false - - --continue-on-error=true - - --plugin-config=/etc/plugins/plugins.yaml - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://status-reconciler/status-reconciler-status - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - # Required when deck runs with `--rerun-creates-job=true` - # **Warning:** Only use this for non-public deck instances, this allows - # anyone with access to your Deck instance to create new Prowjobs - # - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -rules: - - apiGroups: - - "" - resources: - - pods/log - verbs: - - get ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "horologium" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "horologium" -subjects: -- kind: ServiceAccount - name: "horologium" ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "sinker" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - delete - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" - namespace: prow ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "hook" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - get - - list - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "hook" -subjects: -- kind: ServiceAccount - name: "hook" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "tide" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - get - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "tide" -subjects: -- kind: ServiceAccount - name: "tide" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "statusreconciler" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "statusreconciler" -subjects: -- kind: ServiceAccount - name: "statusreconciler" ---- -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - namespace: prow - labels: - app: ghproxy - name: ghproxy -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 100Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: ghproxy - labels: - app: ghproxy -spec: - selector: - matchLabels: - app: ghproxy - strategy: - type: Recreate - # GHProxy does not support HA - replicas: 1 - template: - metadata: - labels: - app: ghproxy - spec: - containers: - - name: ghproxy - image: us-docker.pkg.dev/k8s-infra-prow/images/ghproxy:v20240802-66b115076 - args: - - --cache-dir=/cache - - --cache-sizeGB=99 - - --push-gateway=pushgateway - - --serve-metrics=true - ports: - - containerPort: 8888 - volumeMounts: - - name: cache - mountPath: /cache - volumes: - - name: cache - persistentVolumeClaim: - claimName: ghproxy ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: ghproxy - namespace: prow - name: ghproxy -spec: - ports: - - name: main - port: 80 - protocol: TCP - targetPort: 8888 - - name: metrics - port: 9090 - selector: - app: ghproxy - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --enable-controller=plank - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:v20240802-66b115076 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: prow-controller-manager ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager - namespace: prow ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: crier - labels: - app: crier -spec: - replicas: 1 - selector: - matchLabels: - app: crier - template: - metadata: - labels: - app: crier - spec: - serviceAccountName: crier - terminationGracePeriodSeconds: 30 - containers: - - name: crier - image: us-docker.pkg.dev/k8s-infra-prow/images/crier:v20240802-66b115076 - args: - - --blob-storage-workers=10 - - --config-path=/etc/config/config.yaml - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-workers=10 - - --kubernetes-blob-storage-workers=10 - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: s3-credentials - secret: - secretName: s3-credentials ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - name: crier - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: crier -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - "prowjobs" - verbs: - - "get" - - "watch" - - "list" - - "patch" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: crier -rules: -- apiGroups: - - "" - resources: - - "pods" - - "events" - verbs: - - "get" - - "list" -- apiGroups: - - "" - resources: - - "pods" - verbs: - - "patch" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: prow -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$AZURE_STORAGE_ACCOUNT_USER", - "endpoint": "minio.prow.svc.cluster.local", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$AZURE_STORAGE_ACCOUNT_PASSWORD" - } ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: test-pods - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$AZURE_STORAGE_ACCOUNT_USER", - "endpoint": "minio.prow.svc.cluster.local", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$AZURE_STORAGE_ACCOUNT_PASSWORD" - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: minio - namespace: prow -spec: - selector: - matchLabels: - app: minio - strategy: - type: Recreate - template: - metadata: - labels: - app: minio - spec: - containers: - - name: minio - image: minio/minio:latest - args: - - gateway - - azure - - --console-address=:0.0.0.0:$MINIO_CONSOLE_PORT - env: - - name: MINIO_ROOT_USER - valueFrom: - secretKeyRef: - name: minio-root-creds - key: user - - name: MINIO_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: minio-root-creds - key: password - - name: MINIO_REGION_NAME - value: minio - ports: - - containerPort: 9000 - readinessProbe: - httpGet: - path: /minio/health/ready - port: 9000 - periodSeconds: 20 - livenessProbe: - httpGet: - path: /minio/health/live - port: 9000 ---- -apiVersion: v1 -kind: Service -metadata: - name: minio - namespace: prow -spec: - type: ClusterIP - ports: - - port: 80 - targetPort: 9000 - protocol: TCP - selector: - app: minio ---- -apiVersion: v1 -kind: Service -metadata: - name: minio-console - namespace: prow -spec: - type: NodePort - ports: - - port: 8003 - targetPort: $MINIO_CONSOLE_PORT - protocol: TCP - selector: - app: minio diff --git a/config/prow/cluster/starter/starter-gcs.yaml b/config/prow/cluster/starter/starter-gcs.yaml deleted file mode 100644 index 1960b99beeb8..000000000000 --- a/config/prow/cluster/starter/starter-gcs.yaml +++ /dev/null @@ -1,1242 +0,0 @@ -# This file contains Kubernetes YAML files for the most important prow -# components. Don't edit resources in this file. Instead, pull them out into -# their own files. ---- -apiVersion: v1 -kind: Namespace -metadata: - name: prow ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: plugins -data: - plugins.yaml: | - plugins: - $GITHUB_ORG: - plugins: - - approve - - assign - - blunderbuss - - cat - - dog - - help - - heart - - hold - - label - - lgtm - - trigger - - verify-owners - - wip - - yuks ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: github-token -stringData: - cert: $GITHUB_TOKEN - appid: "$GITHUB_APP_ID" ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: hmac-token -stringData: - # Generate via `openssl rand -hex 20`. This is the secret used in the GitHub webhook configuration - hmac: $HMAC_TOKEN ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: config -data: - config.yaml: | - prowjob_namespace: prow - pod_namespace: test-pods - - in_repo_config: - enabled: - "*": true - - deck: - spyglass: - lenses: - - lens: - name: metadata - required_files: - - ^(?:started|finished)\.json$ - optional_files: - - ^(?:podinfo|prowjob)\.json$ - - lens: - config: - name: buildlog - required_files: - - build-log.txt - - lens: - name: junit - required_files: - - .*/junit.*\.xml - - lens: - name: podinfo - required_files: - - podinfo.json - - plank: - job_url_prefix_config: - "*": https://$PROW_HOST/view/ - report_templates: - '*': >- - [Full PR test history](https://$PROW_HOST/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). - [Your PR dashboard](https://$PROW_HOST/pr?query=is:pr+state:open+author:{{with - index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). - default_decoration_config_entries: - - config: - gcs_configuration: - bucket: gs://your-bucket-name - path_strategy: explicit - gcs_credentials_secret: gcs-credentials - github_api_endpoints: - - http://ghproxy - - https://api.github.com - github_app_id: "$GITHUB_APP_ID" - github_app_private_key_secret: - name: github-token - key: cert - utility_images: - clonerefs: us-docker.pkg.dev/k8s-infra-prow/images/clonerefs:v20240802-66b115076 - entrypoint: us-docker.pkg.dev/k8s-infra-prow/images/entrypoint:v20240802-66b115076 - initupload: us-docker.pkg.dev/k8s-infra-prow/images/initupload:v20240802-66b115076 - sidecar: us-docker.pkg.dev/k8s-infra-prow/images/sidecar:v20240802-66b115076 - - tide: - queries: - - labels: - - lgtm - - approved - missingLabels: - - needs-rebase - - do-not-merge/hold - - do-not-merge/work-in-progress - - do-not-merge/invalid-owners-file - orgs: - - $GITHUB_ORG - - decorate_all_jobs: true - periodics: - - interval: 1m - agent: kubernetes - name: echo-test - spec: - containers: - - image: alpine - command: ["/bin/date"] ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: hook - labels: - app: hook -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: hook - template: - metadata: - labels: - app: hook - spec: - serviceAccountName: "hook" - terminationGracePeriodSeconds: 180 - containers: - - name: hook - image: us-docker.pkg.dev/k8s-infra-prow/images/hook:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: hmac - secret: - secretName: hmac-token - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: hook -spec: - selector: - app: hook - ports: - - port: 8888 - type: NodePort ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: sinker - labels: - app: sinker -spec: - selector: - matchLabels: - app: sinker - replicas: 1 - template: - metadata: - labels: - app: sinker - spec: - serviceAccountName: "sinker" - containers: - - name: sinker - image: us-docker.pkg.dev/k8s-infra-prow/images/sinker:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --dry-run=false - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: deck - labels: - app: deck -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: deck - template: - metadata: - labels: - app: deck - spec: - serviceAccountName: "deck" - terminationGracePeriodSeconds: 30 - containers: - - name: deck - image: us-docker.pkg.dev/k8s-infra-prow/images/deck:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --plugin-config=/etc/plugins/plugins.yaml - - --tide-url=http://tide/ - - --hook-url=http://hook:8888/plugin-help - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --spyglass=true - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: gcs-credentials - mountPath: /etc/gcs-credentials - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: plugins - configMap: - name: plugins - - name: gcs-credentials - secret: - secretName: gcs-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: deck -spec: - selector: - app: deck - ports: - - port: 80 - targetPort: 8080 - type: NodePort ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: horologium - labels: - app: horologium -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: horologium - template: - metadata: - labels: - app: horologium - spec: - serviceAccountName: "horologium" - terminationGracePeriodSeconds: 30 - containers: - - name: horologium - image: us-docker.pkg.dev/k8s-infra-prow/images/horologium:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: tide - labels: - app: tide -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: tide - template: - metadata: - labels: - app: tide - spec: - serviceAccountName: "tide" - containers: - - name: tide - image: us-docker.pkg.dev/k8s-infra-prow/images/tide:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --gcs-credentials-file=/etc/gcs-credentials/service-account.json - - --status-path=gs://your-bucket-name/tide-status - - --history-uri=gs://your-bucket-name/tide-history.json - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: gcs-credentials - mountPath: /etc/gcs-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: gcs-credentials - secret: - secretName: gcs-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: tide -spec: - selector: - app: tide - ports: - - port: 80 - targetPort: 8888 - type: NodePort ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: prow - name: prow - annotations: - # Change this to your issuer when using cert-manager. Does - # nothing when not using cert-manager. - cert-manager.io/cluster-issuer: letsencrypt-staging -spec: - defaultBackend: - # specify the default backend for `ingress-gce` (https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#default_backend) - service: - name: deck - port: - number: 80 - rules: - - host: $PROW_HOST - http: - paths: - - path: / - pathType: ImplementationSpecific - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: ImplementationSpecific - backend: - service: - name: hook - port: - number: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: statusreconciler - namespace: prow - labels: - app: statusreconciler -spec: - replicas: 1 - selector: - matchLabels: - app: statusreconciler - template: - metadata: - labels: - app: statusreconciler - spec: - serviceAccountName: statusreconciler - terminationGracePeriodSeconds: 180 - containers: - - name: statusreconciler - image: us-docker.pkg.dev/k8s-infra-prow/images/status-reconciler:v20240802-66b115076 - args: - - --dry-run=false - - --continue-on-error=true - - --plugin-config=/etc/plugins/plugins.yaml - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --gcs-credentials-file=/etc/gcs-credentials/service-account.json - - --status-path=gs://your-bucket-name/status-reconciler-status - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: gcs-credentials - mountPath: /etc/gcs-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins - - name: gcs-credentials - secret: - secretName: gcs-credentials ---- -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - # Required when deck runs with `--rerun-creates-job=true` - # **Warning:** Only use this for non-public deck instances, this allows - # anyone with access to your Deck instance to create new Prowjobs - # - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -rules: - - apiGroups: - - "" - resources: - - pods/log - verbs: - - get ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "horologium" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "horologium" -subjects: -- kind: ServiceAccount - name: "horologium" ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "sinker" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - delete - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" - namespace: prow ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "hook" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - get - - list - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "hook" -subjects: -- kind: ServiceAccount - name: "hook" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "tide" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - get - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "tide" -subjects: -- kind: ServiceAccount - name: "tide" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "statusreconciler" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "statusreconciler" -subjects: -- kind: ServiceAccount - name: "statusreconciler" ---- -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - namespace: prow - labels: - app: ghproxy - name: ghproxy -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 100Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: ghproxy - labels: - app: ghproxy -spec: - selector: - matchLabels: - app: ghproxy - strategy: - type: Recreate - # GHProxy does not support HA - replicas: 1 - template: - metadata: - labels: - app: ghproxy - spec: - containers: - - name: ghproxy - image: us-docker.pkg.dev/k8s-infra-prow/images/ghproxy:v20240802-66b115076 - args: - - --cache-dir=/cache - - --cache-sizeGB=99 - - --push-gateway=pushgateway - - --serve-metrics=true - ports: - - containerPort: 8888 - volumeMounts: - - name: cache - mountPath: /cache - volumes: - - name: cache - persistentVolumeClaim: - claimName: ghproxy ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: ghproxy - namespace: prow - name: ghproxy -spec: - ports: - - name: main - port: 80 - protocol: TCP - targetPort: 8888 - - name: metrics - port: 9090 - selector: - app: ghproxy - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --enable-controller=plank - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:v20240802-66b115076 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: prow-controller-manager ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager - namespace: prow ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: crier - labels: - app: crier -spec: - replicas: 1 - selector: - matchLabels: - app: crier - template: - metadata: - labels: - app: crier - spec: - serviceAccountName: crier - terminationGracePeriodSeconds: 30 - containers: - - name: crier - image: us-docker.pkg.dev/k8s-infra-prow/images/crier:v20240802-66b115076 - args: - - --blob-storage-workers=10 - - --config-path=/etc/config/config.yaml - - --gcs-credentials-file=/etc/gcs-credentials/service-account.json - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-workers=10 - - --kubernetes-blob-storage-workers=10 - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: gcs-credentials - mountPath: /etc/gcs-credentials - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: gcs-credentials - secret: - secretName: gcs-credentials ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - name: crier - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: crier -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - "prowjobs" - verbs: - - "get" - - "watch" - - "list" - - "patch" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: crier -rules: -- apiGroups: - - "" - resources: - - "pods" - - "events" - verbs: - - "get" - - "list" -- apiGroups: - - "" - resources: - - "pods" - verbs: - - "patch" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: prow -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow diff --git a/config/prow/cluster/starter/starter-s3-kind.yaml b/config/prow/cluster/starter/starter-s3-kind.yaml deleted file mode 100644 index 0a32849347ec..000000000000 --- a/config/prow/cluster/starter/starter-s3-kind.yaml +++ /dev/null @@ -1,1432 +0,0 @@ -# This file contains Kubernetes YAML files for the most important prow -# components. Don't edit resources in this file. Instead, pull them out into -# their own files. ---- -apiVersion: v1 -kind: Namespace -metadata: - name: prow ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: plugins -data: - plugins.yaml: | - plugins: - $GITHUB_REPO: - plugins: - - approve - - assign - - blunderbuss - - cat - - dog - - help - - heart - - hold - - label - - lgtm - - trigger - - verify-owners - - wip - - yuks ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: github-token -stringData: - cert: $GITHUB_TOKEN - appid: "$GITHUB_APP_ID" ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: hmac-token -stringData: - # Generate via `openssl rand -hex 20`. This is the secret used in the GitHub webhook configuration - hmac: $HMAC_TOKEN ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: minio-root-creds -stringData: - user: "$MINIO_ROOT_USER" - password: "$MINIO_ROOT_PASSWORD" ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: config -data: - config.yaml: | - prowjob_namespace: prow - pod_namespace: test-pods - - in_repo_config: - enabled: - "*": true - - deck: - spyglass: - lenses: - - lens: - name: metadata - required_files: - - started.json|finished.json - - lens: - config: - name: buildlog - required_files: - - build-log.txt - - lens: - name: junit - required_files: - - .*/junit.*\.xml - - lens: - name: podinfo - required_files: - - podinfo.json - - plank: - job_url_prefix_config: - "*": http://$LOCAL_IP:30002/view/ - report_templates: - '*': >- - [Full PR test history](http://$LOCAL_IP:30002/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). - [Your PR dashboard](http://$LOCAL_IP:30002/pr?query=is:pr+state:open+author:{{with - index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). - default_decoration_config_entries: - - config: - gcs_configuration: - bucket: s3://prow-logs - path_strategy: explicit - github_api_endpoints: - - http://ghproxy - - https://api.github.com - github_app_id: "$GITHUB_APP_ID" - github_app_private_key_secret: - name: github-token - key: cert - s3_credentials_secret: s3-credentials - utility_images: - clonerefs: us-docker.pkg.dev/k8s-infra-prow/images/clonerefs:latest - entrypoint: us-docker.pkg.dev/k8s-infra-prow/images/entrypoint:latest - initupload: us-docker.pkg.dev/k8s-infra-prow/images/initupload:latest - sidecar: us-docker.pkg.dev/k8s-infra-prow/images/sidecar:latest - - tide: - queries: - - labels: - - lgtm - - approved - missingLabels: - - needs-rebase - - do-not-merge/hold - - do-not-merge/work-in-progress - - do-not-merge/invalid-owners-file - repos: - - $GITHUB_REPO - - decorate_all_jobs: true - periodics: - - interval: 1m - agent: kubernetes - name: echo-test - spec: - containers: - - image: alpine - command: ["/bin/date"] ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: job-config -data: - job-config.yaml: | - presubmits: - $GITHUB_REPO: - - name: presubmit-echo-test - decorate: true - always_run: true - spec: - containers: - - image: alpine - command: ["/bin/date"] ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: hook - labels: - app: hook -spec: - replicas: 1 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: hook - template: - metadata: - labels: - app: hook - spec: - serviceAccountName: "hook" - terminationGracePeriodSeconds: 180 - containers: - - name: hook - image: us-docker.pkg.dev/k8s-infra-prow/images/hook:latest - imagePullPolicy: Always - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - - --job-config-path=/etc/job-config - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: hmac - secret: - secretName: hmac-token - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: hook - name: hook - namespace: prow -spec: - type: LoadBalancer - selector: - app: hook - ports: - - - name: hook-1 - port: 8888 - targetPort: 8888 - nodePort: 30001 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: sinker - labels: - app: sinker -spec: - selector: - matchLabels: - app: sinker - replicas: 1 - template: - metadata: - labels: - app: sinker - spec: - serviceAccountName: "sinker" - containers: - - name: sinker - image: us-docker.pkg.dev/k8s-infra-prow/images/sinker:latest - args: - - --config-path=/etc/config/config.yaml - - --dry-run=false - - --job-config-path=/etc/job-config - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: deck - labels: - app: deck -spec: - replicas: 1 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: deck - template: - metadata: - labels: - app: deck - spec: - serviceAccountName: "deck" - terminationGracePeriodSeconds: 30 - containers: - - name: deck - image: us-docker.pkg.dev/k8s-infra-prow/images/deck:latest - args: - - --config-path=/etc/config/config.yaml - - --plugin-config=/etc/plugins/plugins.yaml - - --tide-url=http://tide/ - - --hook-url=http://hook:8888/plugin-help - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --spyglass=true - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - - --job-config-path=/etc/job-config - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: deck - name: deck - namespace: prow -spec: - type: LoadBalancer - selector: - app: deck - ports: - - - name: deck-1 - port: 80 - targetPort: 8080 - nodePort: 30002 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: horologium - labels: - app: horologium -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: horologium - template: - metadata: - labels: - app: horologium - spec: - serviceAccountName: "horologium" - terminationGracePeriodSeconds: 30 - containers: - - name: horologium - image: us-docker.pkg.dev/k8s-infra-prow/images/horologium:latest - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: tide - labels: - app: tide -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: tide - template: - metadata: - labels: - app: tide - spec: - serviceAccountName: "tide" - containers: - - name: tide - image: us-docker.pkg.dev/k8s-infra-prow/images/tide:latest - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://tide/tide-status - - --history-uri=s3://tide/tide-history.json - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - - --job-config-path=/etc/job-config - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: s3-credentials - secret: - secretName: s3-credentials - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: tide -spec: - selector: - app: tide - ports: - - port: 80 - targetPort: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: statusreconciler - namespace: prow - labels: - app: statusreconciler -spec: - replicas: 1 - selector: - matchLabels: - app: statusreconciler - template: - metadata: - labels: - app: statusreconciler - spec: - serviceAccountName: statusreconciler - terminationGracePeriodSeconds: 180 - containers: - - name: statusreconciler - image: us-docker.pkg.dev/k8s-infra-prow/images/status-reconciler:latest - args: - - --dry-run=false - - --continue-on-error=true - - --plugin-config=/etc/plugins/plugins.yaml - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://status-reconciler/status-reconciler-status - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - - --job-config-path=/etc/job-config - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - # Required when deck runs with `--rerun-creates-job=true` - # **Warning:** Only use this for non-public deck instances, this allows - # anyone with access to your Deck instance to create new Prowjobs - # - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -rules: - - apiGroups: - - "" - resources: - - pods/log - verbs: - - get ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "horologium" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "horologium" -subjects: -- kind: ServiceAccount - name: "horologium" ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "sinker" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - delete - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" - namespace: prow ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "hook" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - get - - list - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "hook" -subjects: -- kind: ServiceAccount - name: "hook" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "tide" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - get - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "tide" -subjects: -- kind: ServiceAccount - name: "tide" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "statusreconciler" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "statusreconciler" -subjects: -- kind: ServiceAccount - name: "statusreconciler" ---- -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - namespace: prow - labels: - app: ghproxy - name: ghproxy -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: ghproxy - labels: - app: ghproxy -spec: - selector: - matchLabels: - app: ghproxy - strategy: - type: Recreate - # GHProxy does not support HA - replicas: 1 - template: - metadata: - labels: - app: ghproxy - spec: - containers: - - name: ghproxy - image: us-docker.pkg.dev/k8s-infra-prow/images/ghproxy:latest - args: - - --cache-dir=/cache - - --cache-sizeGB=5 - - --push-gateway=pushgateway - - --serve-metrics=true - ports: - - containerPort: 8888 - volumeMounts: - - name: cache - mountPath: /cache - volumes: - - name: cache - persistentVolumeClaim: - claimName: ghproxy ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: ghproxy - namespace: prow - name: ghproxy -spec: - ports: - - name: main - port: 80 - protocol: TCP - targetPort: 8888 - - name: metrics - port: 9090 - selector: - app: ghproxy - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --enable-controller=plank - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - - --job-config-path=/etc/job-config - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:latest - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: prow-controller-manager ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager - namespace: prow ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: crier - labels: - app: crier -spec: - replicas: 1 - selector: - matchLabels: - app: crier - template: - metadata: - labels: - app: crier - spec: - serviceAccountName: crier - terminationGracePeriodSeconds: 30 - containers: - - name: crier - image: us-docker.pkg.dev/k8s-infra-prow/images/crier:latest - args: - - --blob-storage-workers=2 - - --config-path=/etc/config/config.yaml - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-workers=2 - - --kubernetes-blob-storage-workers=2 - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: s3-credentials - secret: - secretName: s3-credentials - - name: job-config - configMap: - name: job-config ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - name: crier - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: crier -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - "prowjobs" - verbs: - - "get" - - "watch" - - "list" - - "patch" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: crier -rules: -- apiGroups: - - "" - resources: - - "pods" - - "events" - verbs: - - "get" - - "list" -- apiGroups: - - "" - resources: - - "pods" - verbs: - - "patch" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: prow -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: minio - namespace: prow -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$MINIO_ROOT_USER", - "endpoint": "minio.prow.svc.cluster.local:9000", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$MINIO_ROOT_PASSWORD" - } ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: test-pods - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$MINIO_ROOT_USER", - "endpoint": "minio.prow.svc.cluster.local:9000", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$MINIO_ROOT_PASSWORD" - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: minio - namespace: prow -spec: - selector: - matchLabels: - app: minio - strategy: - type: Recreate - template: - metadata: - labels: - app: minio - spec: - volumes: - - name: data - persistentVolumeClaim: - claimName: minio - initContainers: - - name: bucket-creator - image: alpine - command: - - mkdir - - -p - - /data/prow-logs - - /data/tide - - /data/status-reconciler - volumeMounts: - - name: data - mountPath: "/data" - containers: - - name: minio - volumeMounts: - - name: data - mountPath: "/data" - image: minio/minio:latest - args: - - server - - /data - env: - - name: MINIO_ROOT_USER - valueFrom: - secretKeyRef: - name: minio-root-creds - key: user - - name: MINIO_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: minio-root-creds - key: password - - name: MINIO_REGION_NAME - value: minio - - name: MINIO_CONSOLE_ADDRESS - value: ":9001" - ports: - - containerPort: 9001 - - containerPort: 9000 - readinessProbe: - httpGet: - path: /minio/health/ready - port: 9000 - periodSeconds: 20 - livenessProbe: - httpGet: - path: /minio/health/live - port: 9000 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: minio - name: minio - namespace: prow -spec: - type: LoadBalancer - selector: - app: minio - ports: - - - name: minio-1 - port: 9001 - targetPort: 9001 - nodePort: 30003 - - - name: minio-2 - port: 9000 - targetPort: 9000 diff --git a/config/prow/cluster/starter/starter-s3.yaml b/config/prow/cluster/starter/starter-s3.yaml deleted file mode 100644 index 7e5652ac0b29..000000000000 --- a/config/prow/cluster/starter/starter-s3.yaml +++ /dev/null @@ -1,1374 +0,0 @@ -# This file contains Kubernetes YAML files for the most important prow -# components. Don't edit resources in this file. Instead, pull them out into -# their own files. ---- -apiVersion: v1 -kind: Namespace -metadata: - name: prow ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: plugins -data: - plugins.yaml: | - plugins: - $GITHUB_ORG: - plugins: - - approve - - assign - - blunderbuss - - cat - - dog - - help - - heart - - hold - - label - - lgtm - - trigger - - verify-owners - - wip - - yuks ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: github-token -stringData: - cert: $GITHUB_TOKEN - appid: "$GITHUB_APP_ID" ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: hmac-token -stringData: - # Generate via `openssl rand -hex 20`. This is the secret used in the GitHub webhook configuration - hmac: $HMAC_TOKEN ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: minio-root-creds -stringData: - user: "$MINIO_ROOT_USER" - password: "$MINIO_ROOT_PASSWORD" ---- -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: prow - name: config -data: - config.yaml: | - prowjob_namespace: prow - pod_namespace: test-pods - - in_repo_config: - enabled: - "*": true - - deck: - spyglass: - gcs_browser_prefix: 'https://s3.console.aws.amazon.com/s3/buckets/' - lenses: - - lens: - name: metadata - required_files: - - ^(?:started|finished)\.json$ - optional_files: - - ^(?:podinfo|prowjob)\.json$ - - lens: - config: - name: buildlog - required_files: - - build-log.txt - - lens: - name: junit - required_files: - - .*/junit.*\.xml - - lens: - name: podinfo - required_files: - - podinfo.json - - plank: - job_url_prefix_config: - "*": https://$PROW_HOST/view/ - report_templates: - '*': >- - [Full PR test history](https://$PROW_HOST/pr-history?org={{.Spec.Refs.Org}}&repo={{.Spec.Refs.Repo}}&pr={{with index .Spec.Refs.Pulls 0}}{{.Number}}{{end}}). - [Your PR dashboard](https://$PROW_HOST/pr?query=is:pr+state:open+author:{{with - index .Spec.Refs.Pulls 0}}{{.Author}}{{end}}). - default_decoration_config_entries: - - config: - gcs_configuration: - bucket: s3://prow-logs - path_strategy: explicit - github_api_endpoints: - - http://ghproxy - - https://api.github.com - github_app_id: "$GITHUB_APP_ID" - github_app_private_key_secret: - name: github-token - key: cert - s3_credentials_secret: s3-credentials - utility_images: - clonerefs: us-docker.pkg.dev/k8s-infra-prow/images/clonerefs:v20240802-66b115076 - entrypoint: us-docker.pkg.dev/k8s-infra-prow/images/entrypoint:v20240802-66b115076 - initupload: us-docker.pkg.dev/k8s-infra-prow/images/initupload:v20240802-66b115076 - sidecar: us-docker.pkg.dev/k8s-infra-prow/images/sidecar:v20240802-66b115076 - - tide: - queries: - - labels: - - lgtm - - approved - missingLabels: - - needs-rebase - - do-not-merge/hold - - do-not-merge/work-in-progress - - do-not-merge/invalid-owners-file - orgs: - - $GITHUB_ORG - - decorate_all_jobs: true - periodics: - - interval: 1m - agent: kubernetes - name: echo-test - spec: - containers: - - image: alpine - command: ["/bin/date"] ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: hook - labels: - app: hook -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: hook - template: - metadata: - labels: - app: hook - spec: - serviceAccountName: "hook" - terminationGracePeriodSeconds: 180 - containers: - - name: hook - image: us-docker.pkg.dev/k8s-infra-prow/images/hook:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: hmac - mountPath: /etc/webhook - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: hmac - secret: - secretName: hmac-token - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: hook -spec: - selector: - app: hook - ports: - - port: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: sinker - labels: - app: sinker -spec: - selector: - matchLabels: - app: sinker - replicas: 1 - template: - metadata: - labels: - app: sinker - spec: - serviceAccountName: "sinker" - containers: - - name: sinker - image: us-docker.pkg.dev/k8s-infra-prow/images/sinker:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --dry-run=false - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: deck - labels: - app: deck -spec: - replicas: 2 - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - selector: - matchLabels: - app: deck - template: - metadata: - labels: - app: deck - spec: - serviceAccountName: "deck" - terminationGracePeriodSeconds: 30 - containers: - - name: deck - image: us-docker.pkg.dev/k8s-infra-prow/images/deck:v20240802-66b115076 - args: - - --config-path=/etc/config/config.yaml - - --plugin-config=/etc/plugins/plugins.yaml - - --tide-url=http://tide/ - - --hook-url=http://hook:8888/plugin-help - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --spyglass=true - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - livenessProbe: - httpGet: - path: /healthz - port: 8081 - initialDelaySeconds: 3 - periodSeconds: 3 - readinessProbe: - httpGet: - path: /healthz/ready - port: 8081 - initialDelaySeconds: 10 - periodSeconds: 3 - timeoutSeconds: 600 - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: deck -spec: - selector: - app: deck - ports: - - port: 80 - targetPort: 8080 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: horologium - labels: - app: horologium -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: horologium - template: - metadata: - labels: - app: horologium - spec: - serviceAccountName: "horologium" - terminationGracePeriodSeconds: 30 - containers: - - name: horologium - image: us-docker.pkg.dev/k8s-infra-prow/images/horologium:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: config - configMap: - name: config ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: tide - labels: - app: tide -spec: - replicas: 1 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: tide - template: - metadata: - labels: - app: tide - spec: - serviceAccountName: "tide" - containers: - - name: tide - image: us-docker.pkg.dev/k8s-infra-prow/images/tide:v20240802-66b115076 - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-graphql-endpoint=http://ghproxy/graphql - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://tide/tide-status - - --history-uri=s3://tide/tide-history.json - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - ports: - - name: http - containerPort: 8888 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Service -metadata: - namespace: prow - name: tide -spec: - selector: - app: tide - ports: - - port: 80 - targetPort: 8888 ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: prow - name: prow - annotations: - # Change this to your issuer when using cert-manager. Does - # nothing when not using cert-manager. - cert-manager.io/cluster-issuer: letsencrypt-staging -spec: - defaultBackend: - # specify the default backend for `ingress-gce` (https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#default_backend) - service: - name: deck - port: - number: 80 - rules: - - host: $PROW_HOST - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: Prefix - backend: - service: - name: hook - port: - number: 8888 ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: statusreconciler - namespace: prow - labels: - app: statusreconciler -spec: - replicas: 1 - selector: - matchLabels: - app: statusreconciler - template: - metadata: - labels: - app: statusreconciler - spec: - serviceAccountName: statusreconciler - terminationGracePeriodSeconds: 180 - containers: - - name: statusreconciler - image: us-docker.pkg.dev/k8s-infra-prow/images/status-reconciler:v20240802-66b115076 - args: - - --dry-run=false - - --continue-on-error=true - - --plugin-config=/etc/plugins/plugins.yaml - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --status-path=s3://status-reconciler/status-reconciler-status - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config - - name: plugins - configMap: - name: plugins - - name: s3-credentials - secret: - secretName: s3-credentials ---- -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "deck" -subjects: -- kind: ServiceAccount - name: "deck" - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "deck" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - # Required when deck runs with `--rerun-creates-job=true` - # **Warning:** Only use this for non-public deck instances, this allows - # anyone with access to your Deck instance to create new Prowjobs - # - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "deck" -rules: - - apiGroups: - - "" - resources: - - pods/log - verbs: - - get ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "horologium" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "horologium" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "horologium" -subjects: -- kind: ServiceAccount - name: "horologium" ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - namespace: prow - name: "sinker" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - delete - - list - - watch - - get - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-sinker-leaderlock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - delete - - list - - watch - - get - - patch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: "sinker" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "sinker" -subjects: -- kind: ServiceAccount - name: "sinker" - namespace: prow ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "hook" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - get - - list - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - update ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "hook" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "hook" -subjects: -- kind: ServiceAccount - name: "hook" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "tide" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - get - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "tide" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "tide" -subjects: -- kind: ServiceAccount - name: "tide" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: "statusreconciler" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: "statusreconciler" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: "statusreconciler" -subjects: -- kind: ServiceAccount - name: "statusreconciler" ---- -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - namespace: prow - labels: - app: ghproxy - name: ghproxy -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 100Gi ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: ghproxy - labels: - app: ghproxy -spec: - selector: - matchLabels: - app: ghproxy - strategy: - type: Recreate - # GHProxy does not support HA - replicas: 1 - template: - metadata: - labels: - app: ghproxy - spec: - containers: - - name: ghproxy - image: us-docker.pkg.dev/k8s-infra-prow/images/ghproxy:v20240802-66b115076 - args: - - --cache-dir=/cache - - --cache-sizeGB=99 - - --push-gateway=pushgateway - - --serve-metrics=true - ports: - - containerPort: 8888 - volumeMounts: - - name: cache - mountPath: /cache - volumes: - - name: cache - persistentVolumeClaim: - claimName: ghproxy ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: ghproxy - namespace: prow - name: ghproxy -spec: - ports: - - name: main - port: 80 - protocol: TCP - targetPort: 8888 - - name: metrics - port: 9090 - selector: - app: ghproxy - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - args: - - --dry-run=false - - --config-path=/etc/config/config.yaml - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --enable-controller=plank - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:v20240802-66b115076 - volumeMounts: - - name: github-token - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - volumes: - - name: github-token - secret: - secretName: github-token - - name: config - configMap: - name: config ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: prow - name: prow-controller-manager ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager - namespace: prow ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: prow - name: crier - labels: - app: crier -spec: - replicas: 1 - selector: - matchLabels: - app: crier - template: - metadata: - labels: - app: crier - spec: - serviceAccountName: crier - terminationGracePeriodSeconds: 30 - containers: - - name: crier - image: us-docker.pkg.dev/k8s-infra-prow/images/crier:v20240802-66b115076 - args: - - --blob-storage-workers=10 - - --config-path=/etc/config/config.yaml - - --s3-credentials-file=/etc/s3-credentials/service-account.json - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-workers=10 - - --kubernetes-blob-storage-workers=10 - - --github-app-id=$(GITHUB_APP_ID) - - --github-app-private-key-path=/etc/github/cert - env: - - name: GITHUB_APP_ID - valueFrom: - secretKeyRef: - name: github-token - key: appid - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: github-token - mountPath: /etc/github - readOnly: true - - name: s3-credentials - mountPath: /etc/s3-credentials - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: github-token - secret: - secretName: github-token - - name: s3-credentials - secret: - secretName: s3-credentials ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - name: crier - namespace: prow ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: prow - name: crier -rules: -- apiGroups: - - "prow.k8s.io" - resources: - - "prowjobs" - verbs: - - "get" - - "watch" - - "list" - - "patch" ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: crier -rules: -- apiGroups: - - "" - resources: - - "pods" - - "events" - verbs: - - "get" - - "list" -- apiGroups: - - "" - resources: - - "pods" - verbs: - - "patch" ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: prow -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: crier - namespace: test-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: crier -subjects: -- kind: ServiceAccount - name: crier - namespace: prow ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: minio - namespace: prow -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 100Gi ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: prow - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$MINIO_ROOT_USER", - "endpoint": "minio.prow.svc.cluster.local", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$MINIO_ROOT_PASSWORD" - } ---- -apiVersion: v1 -kind: Secret -metadata: - namespace: test-pods - name: s3-credentials -stringData: - service-account.json: | - { - "region": "minio", - "access_key": "$MINIO_ROOT_USER", - "endpoint": "minio.prow.svc.cluster.local", - "insecure": true, - "s3_force_path_style": true, - "secret_key": "$MINIO_ROOT_PASSWORD" - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: minio - namespace: prow -spec: - selector: - matchLabels: - app: minio - strategy: - type: Recreate - template: - metadata: - labels: - app: minio - spec: - volumes: - - name: data - persistentVolumeClaim: - claimName: minio - initContainers: - - name: bucket-creator - image: alpine - command: - - mkdir - - -p - - /data/prow-logs - - /data/tide - - /data/status-reconciler - volumeMounts: - - name: data - mountPath: "/data" - containers: - - name: minio - volumeMounts: - - name: data - mountPath: "/data" - image: minio/minio:latest - args: - - server - - /data - env: - - name: MINIO_ROOT_USER - valueFrom: - secretKeyRef: - name: minio-root-creds - key: user - - name: MINIO_ROOT_PASSWORD - valueFrom: - secretKeyRef: - name: minio-root-creds - key: password - - name: MINIO_REGION_NAME - value: minio - ports: - - containerPort: 9000 - readinessProbe: - httpGet: - path: /minio/health/ready - port: 9000 - periodSeconds: 20 - livenessProbe: - httpGet: - path: /minio/health/live - port: 9000 ---- -apiVersion: v1 -kind: Service -metadata: - name: minio - namespace: prow -spec: - type: ClusterIP - ports: - - port: 80 - targetPort: 9000 - protocol: TCP - selector: - app: minio diff --git a/config/prow/cluster/statusreconciler_deployment.yaml b/config/prow/cluster/statusreconciler_deployment.yaml deleted file mode 100644 index 9460c2238365..000000000000 --- a/config/prow/cluster/statusreconciler_deployment.yaml +++ /dev/null @@ -1,73 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: statusreconciler - labels: - app: statusreconciler -spec: - replicas: 0 - selector: - matchLabels: - app: statusreconciler - template: - metadata: - labels: - app: statusreconciler - spec: - serviceAccountName: statusreconciler - terminationGracePeriodSeconds: 180 - containers: - - name: statusreconciler - image: us-docker.pkg.dev/k8s-infra-prow/images/status-reconciler:v20240802-66b115076 - imagePullPolicy: Always - args: - - --dry-run=false - - --continue-on-error=true - - --plugin-config=/etc/plugins/plugins.yaml - - --config-path=/etc/config/config.yaml - - --github-token-path=/etc/github/oauth - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --job-config-path=/etc/job-config - - --denylist=kubernetes/kubernetes - volumeMounts: - - name: oauth - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - - name: plugins - mountPath: /etc/plugins - readOnly: true - volumes: - - name: oauth - secret: - secretName: oauth-token - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config - - name: plugins - configMap: - name: plugins diff --git a/config/prow/cluster/statusreconciler_rbac.yaml b/config/prow/cluster/statusreconciler_rbac.yaml deleted file mode 100644 index 847cfb47c156..000000000000 --- a/config/prow/cluster/statusreconciler_rbac.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: statusreconciler ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: statusreconciler -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: statusreconciler -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: statusreconciler -subjects: -- kind: ServiceAccount - name: statusreconciler diff --git a/config/prow/cluster/test-pods_namespace.yaml b/config/prow/cluster/test-pods_namespace.yaml deleted file mode 100644 index eff8a8612f0b..000000000000 --- a/config/prow/cluster/test-pods_namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: test-pods diff --git a/config/prow/cluster/tide_deployment.yaml b/config/prow/cluster/tide_deployment.yaml deleted file mode 100644 index 8f95e40e81dc..000000000000 --- a/config/prow/cluster/tide_deployment.yaml +++ /dev/null @@ -1,71 +0,0 @@ -# Copyright 2017 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: tide - labels: - app: tide -spec: - replicas: 0 # Do not scale up. - strategy: - type: Recreate - selector: - matchLabels: - app: tide - template: - metadata: - labels: - app: tide - spec: - serviceAccountName: tide - containers: - - name: tide - image: us-docker.pkg.dev/k8s-infra-prow/images/tide:v20240802-66b115076 - args: - - --dry-run=false - - --github-endpoint=http://ghproxy - - --github-endpoint=https://api.github.com - - --github-token-path=/etc/github/oauth - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - - --history-uri=gs://k8s-prow/tide-history.json - - --status-path=gs://k8s-prow/tide-status-checkpoint.yaml - ports: - - name: http - containerPort: 8888 - - name: metrics - containerPort: 9090 - volumeMounts: - - name: oauth - mountPath: /etc/github - readOnly: true - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: oauth - secret: - secretName: oauth-token - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config diff --git a/config/prow/cluster/tide_rbac.yaml b/config/prow/cluster/tide_rbac.yaml deleted file mode 100644 index 65ce3f570429..000000000000 --- a/config/prow/cluster/tide_rbac.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - iam.gke.io/gcp-service-account: control-plane@k8s-prow.iam.gserviceaccount.com - namespace: default - name: tide ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: tide -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - create - - list - - get - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: tide -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: tide -subjects: -- kind: ServiceAccount - name: tide diff --git a/config/prow/cluster/tide_service.yaml b/config/prow/cluster/tide_service.yaml deleted file mode 100644 index 00ba9ae5c035..000000000000 --- a/config/prow/cluster/tide_service.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# Copyright 2017 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Service -metadata: - labels: - app: tide - namespace: default - name: tide -spec: - selector: - app: tide - ports: - - name: main - port: 80 - targetPort: 8888 - protocol: TCP - - name: metrics - port: 9090 - protocol: TCP - type: ClusterIP diff --git a/config/prow/cluster/tls-ing_ingress.yaml b/config/prow/cluster/tls-ing_ingress.yaml deleted file mode 100644 index 7138f39bc290..000000000000 --- a/config/prow/cluster/tls-ing_ingress.yaml +++ /dev/null @@ -1,73 +0,0 @@ -# Copyright 2016 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: default - name: tls-ing - annotations: - kubernetes.io/ingress.global-static-ip-name: prow - kubernetes.io/ingress.class: "gce" - networking.gke.io/managed-certificates: prow-k8s-io, prow-kubernetes-io -spec: - rules: - - host: prow.k8s.io - http: - paths: - - path: /* - pathType: ImplementationSpecific - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: ImplementationSpecific - backend: - service: - name: hook - port: - number: 8888 - - path: /metrics - pathType: ImplementationSpecific - backend: - service: - name: pushgateway-external - port: - number: 80 - - host: prow.kubernetes.io - http: - paths: - - path: /* - pathType: ImplementationSpecific - backend: - service: - name: deck - port: - number: 80 - - path: /hook - pathType: ImplementationSpecific - backend: - service: - name: hook - port: - number: 8888 - - path: /metrics - pathType: ImplementationSpecific - backend: - service: - name: pushgateway-external - port: - number: 80 diff --git a/config/prow/cluster/trusted_serviceaccounts.yaml b/config/prow/cluster/trusted_serviceaccounts.yaml deleted file mode 100644 index 4b9928f45b16..000000000000 --- a/config/prow/cluster/trusted_serviceaccounts.yaml +++ /dev/null @@ -1,78 +0,0 @@ ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: pusher@k8s-prow.iam.gserviceaccount.com - name: pusher - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: testgrid-config-updater@k8s-testgrid.iam.gserviceaccount.com - name: testgrid-config-updater - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: deployer@k8s-prow.iam.gserviceaccount.com - name: deployer - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: gencred-refresher@k8s-prow.iam.gserviceaccount.com - name: gencred-refresher - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com - name: k8s-infra-gcr-promoter - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod-bak.iam.gserviceaccount.com - name: k8s-infra-gcr-promoter-bak - namespace: test-pods ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: kubernetes-external-secrets-sa@k8s-prow.iam.gserviceaccount.com - name: kubernetes-external-secrets-sa - namespace: default ---- -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: prowjob-default-sa@k8s-prow.iam.gserviceaccount.com - name: prowjob-default-sa - namespace: test-pods ---- -# legacy-sa-json-key-rotator is used for rotating the default build cluster sa -# json key, and should only be used for this purpose. This GCP SA will be -# granted secret manager owner permission on the -# default-k8s-build-cluster-service-account-key secret in k8s-prow-builds -# project, and service account key list/create/delete permission on the -# pr-kubekins@kubernetes-jenkins-pull.iam.gserviceaccount.com SA. -kind: ServiceAccount -apiVersion: v1 -metadata: - annotations: - iam.gke.io/gcp-service-account: legacy-sa-json-key-rotator@k8s-prow.iam.gserviceaccount.com - name: legacy-sa-json-key-rotator - namespace: test-pods diff --git a/config/prow/experimental/controller_manager.yaml b/config/prow/experimental/controller_manager.yaml deleted file mode 100644 index eb64bb5a684a..000000000000 --- a/config/prow/experimental/controller_manager.yaml +++ /dev/null @@ -1,123 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: default - name: prow-controller-manager - labels: - app: prow-controller-manager -spec: - replicas: 1 - selector: - matchLabels: - app: prow-controller-manager - template: - metadata: - labels: - app: prow-controller-manager - spec: - serviceAccountName: prow-controller-manager - containers: - - name: prow-controller-manager - args: - - --config-path=/etc/config/config.yaml - - --job-config-path=/etc/job-config - - --dry-run=false - image: us-docker.pkg.dev/k8s-infra-prow/images/prow-controller-manager:v20240802-66b115076 - volumeMounts: - - name: config - mountPath: /etc/config - readOnly: true - - name: job-config - mountPath: /etc/job-config - readOnly: true - volumes: - - name: config - configMap: - name: config - - name: job-config - configMap: - name: job-config ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: default - name: prow-controller-manager ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: prow-controller-manager -rules: - - apiGroups: - - "prow.k8s.io" - resources: - - prowjobs - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - "" - resources: - - configmaps - resourceNames: - - prow-controller-manager-leader-lock - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - - events - verbs: - - create ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - create - - delete - - get - - list - - patch - - watch ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: default - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - namespace: test-pods - name: prow-controller-manager -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: prow-controller-manager -subjects: -- kind: ServiceAccount - name: prow-controller-manager - namespace: default From d12896ffc070bfad82e477cbc03c17024eb1df49 Mon Sep 17 00:00:00 2001 From: Benjamin Elder Date: Mon, 16 Mar 2026 14:06:34 -0700 Subject: [PATCH 2/2] remove config/prow/cluster from yamllint.sh --- hack/make-rules/verify/yamllint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hack/make-rules/verify/yamllint.sh b/hack/make-rules/verify/yamllint.sh index 6959cef37e6c..f75ea2cd8f7c 100755 --- a/hack/make-rules/verify/yamllint.sh +++ b/hack/make-rules/verify/yamllint.sh @@ -29,7 +29,7 @@ elif ! (command -v docker >/dev/null); then exit 1 fi -LINT_COMMAND=("yamllint" "-c" "config/jobs/.yamllint.conf" "config/jobs" "config/prow/cluster") +LINT_COMMAND=("yamllint" "-c" "config/jobs/.yamllint.conf" "config/jobs") "${DOCKER[@]}" run \ --rm -i \