Skip to content

API Reference

Packages:

kamaji.clastix.io/v1alpha1

Resource Types:

DataStore

DataStore is the Schema for the datastores API.

Name Type Description Required
apiVersion string kamaji.clastix.io/v1alpha1 true
kind string DataStore true
metadata object Refer to the Kubernetes API documentation for the fields of the `metadata` field. true
spec object DataStoreSpec defines the desired state of DataStore.
false
status object DataStoreStatus defines the observed state of DataStore.
false

DataStore.spec

DataStoreSpec defines the desired state of DataStore.

Name Type Description Required
driver enum The driver to use to connect to the shared datastore.

Enum: etcd, MySQL, PostgreSQL
true
endpoints []string List of the endpoints to connect to the shared datastore. No need for protocol, just bare IP/FQDN and port.
true
tlsConfig object Defines the TLS/SSL configuration required to connect to the data store in a secure way.
true
basicAuth object In case of authentication enabled for the given data store, specifies the username and password pair. This value is optional.
false

DataStore.spec.tlsConfig

Defines the TLS/SSL configuration required to connect to the data store in a secure way.

Name Type Description Required
certificateAuthority object Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference. The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
true
clientCertificate object Specifies the SSL/TLS key and private key pair used to connect to the data store.
true

DataStore.spec.tlsConfig.certificateAuthority

Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference. The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.

Name Type Description Required
certificate object
true
privateKey object
false

DataStore.spec.tlsConfig.certificateAuthority.certificate

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.tlsConfig.certificateAuthority.certificate.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.spec.tlsConfig.certificateAuthority.privateKey

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.tlsConfig.certificateAuthority.privateKey.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.spec.tlsConfig.clientCertificate

Specifies the SSL/TLS key and private key pair used to connect to the data store.

Name Type Description Required
certificate object
true
privateKey object
true

DataStore.spec.tlsConfig.clientCertificate.certificate

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.tlsConfig.clientCertificate.certificate.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.spec.tlsConfig.clientCertificate.privateKey

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.tlsConfig.clientCertificate.privateKey.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.spec.basicAuth

In case of authentication enabled for the given data store, specifies the username and password pair. This value is optional.

Name Type Description Required
password object
true
username object
true

DataStore.spec.basicAuth.password

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.basicAuth.password.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.spec.basicAuth.username

Name Type Description Required
content string Bare content of the file, base64 encoded. It has precedence over the SecretReference value.

Format: byte
false
secretReference object
false

DataStore.spec.basicAuth.username.secretReference

Name Type Description Required
keyPath string Name of the key for the given Secret reference where the content is stored. This value is mandatory.
true
name string name is unique within a namespace to reference a secret resource.
false
namespace string namespace defines the space within which the secret name must be unique.
false

DataStore.status

DataStoreStatus defines the observed state of DataStore.

Name Type Description Required
usedBy []string List of the Tenant Control Planes, namespaced named, using this data store.
false

TenantControlPlane

TenantControlPlane is the Schema for the tenantcontrolplanes API.

Name Type Description Required
apiVersion string kamaji.clastix.io/v1alpha1 true
kind string TenantControlPlane true
metadata object Refer to the Kubernetes API documentation for the fields of the `metadata` field. true
spec object TenantControlPlaneSpec defines the desired state of TenantControlPlane.
false
status object TenantControlPlaneStatus defines the observed state of TenantControlPlane.
false

TenantControlPlane.spec

TenantControlPlaneSpec defines the desired state of TenantControlPlane.

Name Type Description Required
controlPlane object ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster, such as the number of Pod replicas, the Service resource, or the Ingress.
true
kubernetes object Kubernetes specification for tenant control plane
true
addons object Addons contain which addons are enabled
false
dataStore string DataStore allows to specify a DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane. This parameter is optional and acts as an override over the default one which is used by the Kamaji Operator. Migration from a different DataStore to another one is not yet supported and the reconciliation will be blocked.
false
networkProfile object NetworkProfile specifies how the network is
false

TenantControlPlane.spec.controlPlane

ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster, such as the number of Pod replicas, the Service resource, or the Ingress.

Name Type Description Required
service object Defining the options for the Tenant Control Plane Service resource.
true
deployment object Defining the options for the deployed Tenant Control Plane as Deployment resource.
false
ingress object Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane
false

TenantControlPlane.spec.controlPlane.service

Defining the options for the Tenant Control Plane Service resource.

Name Type Description Required
serviceType enum ServiceType allows specifying how to expose the Tenant Control Plane.

Enum: ClusterIP, NodePort, LoadBalancer
true
additionalMetadata object AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
false

TenantControlPlane.spec.controlPlane.service.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name Type Description Required
annotations map[string]string
false
labels map[string]string
false

TenantControlPlane.spec.controlPlane.deployment

Defining the options for the deployed Tenant Control Plane as Deployment resource.

Name Type Description Required
additionalMetadata object AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
false
affinity object If specified, the Tenant Control Plane pod's scheduling constraints. More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/
false
extraArgs object ExtraArgs allows adding additional arguments to the Control Plane components, such as kube-apiserver, controller-manager, and scheduler.
false
nodeSelector map[string]string NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
false
replicas integer

Format: int32
Default: 2
false
resources object Resources defines the amount of memory and CPU to allocate to each component of the Control Plane (kube-apiserver, controller-manager, and scheduler).
false
runtimeClassName string RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run the Tenant Control Plane pod. If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
false
strategy object Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane. Default value is set to Rolling Update, with a blue/green strategy.

Default: map[rollingUpdate:map[maxSurge:100% maxUnavailable:0] type:RollingUpdate]
false
tolerations []object If specified, the Tenant Control Plane pod's tolerations. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
false
topologySpreadConstraints []object TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used. All topologySpreadConstraints are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name Type Description Required
annotations map[string]string
false
labels map[string]string
false

TenantControlPlane.spec.controlPlane.deployment.affinity

If specified, the Tenant Control Plane pod's scheduling constraints. More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/

Name Type Description Required
nodeAffinity object Describes node affinity scheduling rules for the pod.
false
podAffinity object Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
false
podAntiAffinity object Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name Type Description Required
preferredDuringSchedulingIgnoredDuringExecution []object The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
false
requiredDuringSchedulingIgnoredDuringExecution object If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name Type Description Required
preference object A node selector term, associated with the corresponding weight.
true
weight integer Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.

Format: int32
true

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name Type Description Required
matchExpressions []object A list of node selector requirements by node's labels.
false
matchFields []object A list of node selector requirements by node's fields.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string The label key that the selector applies to.
true
operator string Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
true
values []string An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string The label key that the selector applies to.
true
operator string Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
true
values []string An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name Type Description Required
nodeSelectorTerms []object Required. A list of node selector terms. The terms are ORed.
true

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name Type Description Required
matchExpressions []object A list of node selector requirements by node's labels.
false
matchFields []object A list of node selector requirements by node's fields.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string The label key that the selector applies to.
true
operator string Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
true
values []string An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string The label key that the selector applies to.
true
operator string Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
true
values []string An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name Type Description Required
preferredDuringSchedulingIgnoredDuringExecution []object The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
false
requiredDuringSchedulingIgnoredDuringExecution []object If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name Type Description Required
podAffinityTerm object Required. A pod affinity term, associated with the corresponding weight.
true
weight integer weight associated with matching the corresponding podAffinityTerm, in the range 1-100.

Format: int32
true

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name Type Description Required
topologyKey string This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
true
labelSelector object A label query over a set of resources, in this case pods.
false
namespaceSelector object A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
false
namespaces []string namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name Type Description Required
topologyKey string This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
true
labelSelector object A label query over a set of resources, in this case pods.
false
namespaceSelector object A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
false
namespaces []string namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name Type Description Required
preferredDuringSchedulingIgnoredDuringExecution []object The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
false
requiredDuringSchedulingIgnoredDuringExecution []object If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name Type Description Required
podAffinityTerm object Required. A pod affinity term, associated with the corresponding weight.
true
weight integer weight associated with matching the corresponding podAffinityTerm, in the range 1-100.

Format: int32
true

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name Type Description Required
topologyKey string This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
true
labelSelector object A label query over a set of resources, in this case pods.
false
namespaceSelector object A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
false
namespaces []string namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name Type Description Required
topologyKey string This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
true
labelSelector object A label query over a set of resources, in this case pods.
false
namespaceSelector object A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.
false
namespaces []string namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.deployment.extraArgs

ExtraArgs allows adding additional arguments to the Control Plane components, such as kube-apiserver, controller-manager, and scheduler.

Name Type Description Required
apiServer []string
false
controllerManager []string
false
kine []string Available only if Kamaji is running using Kine as backing storage.
false
scheduler []string
false

TenantControlPlane.spec.controlPlane.deployment.resources

Resources defines the amount of memory and CPU to allocate to each component of the Control Plane (kube-apiserver, controller-manager, and scheduler).

Name Type Description Required
apiServer object ComponentResourceRequirements describes the compute resource requirements.
false
controllerManager object ComponentResourceRequirements describes the compute resource requirements.
false
scheduler object ComponentResourceRequirements describes the compute resource requirements.
false

TenantControlPlane.spec.controlPlane.deployment.resources.apiServer

ComponentResourceRequirements describes the compute resource requirements.

Name Type Description Required
limits map[string]int or string Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false
requests map[string]int or string Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false

TenantControlPlane.spec.controlPlane.deployment.resources.controllerManager

ComponentResourceRequirements describes the compute resource requirements.

Name Type Description Required
limits map[string]int or string Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false
requests map[string]int or string Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false

TenantControlPlane.spec.controlPlane.deployment.resources.scheduler

ComponentResourceRequirements describes the compute resource requirements.

Name Type Description Required
limits map[string]int or string Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false
requests map[string]int or string Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false

TenantControlPlane.spec.controlPlane.deployment.strategy

Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane. Default value is set to Rolling Update, with a blue/green strategy.

Name Type Description Required
rollingUpdate object Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. --- TODO: Update this to follow our convention for oneOf, whatever we decide it to be.
false
type string Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
false

TenantControlPlane.spec.controlPlane.deployment.strategy.rollingUpdate

Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. --- TODO: Update this to follow our convention for oneOf, whatever we decide it to be.

Name Type Description Required
maxSurge int or string The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods.
false
maxUnavailable int or string The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods.
false

TenantControlPlane.spec.controlPlane.deployment.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator .

Name Type Description Required
effect string Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
false
key string Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
false
operator string Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.
false
tolerationSeconds integer TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.

Format: int64
false
value string Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name Type Description Required
maxSkew integer MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.

Format: int32
true
topologyKey string TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.
true
whenUnsatisfiable string WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.
true
labelSelector object LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.
false
matchLabelKeys []string MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.
false
minDomains integer MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default).

Format: int32
false
nodeAffinityPolicy string NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
false
nodeTaintsPolicy string NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name Type Description Required
matchExpressions []object matchExpressions is a list of label selector requirements. The requirements are ANDed.
false
matchLabels map[string]string matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name Type Description Required
key string key is the label key that the selector applies to.
true
operator string operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
true
values []string values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
false

TenantControlPlane.spec.controlPlane.ingress

Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane

Name Type Description Required
additionalMetadata object AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.
false
hostname string Hostname is an optional field which will be used as Ingress's Host. If it is not defined, Ingress's host will be "..", where domain is specified under NetworkProfileSpec
false
ingressClassName string
false

TenantControlPlane.spec.controlPlane.ingress.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name Type Description Required
annotations map[string]string
false
labels map[string]string
false

TenantControlPlane.spec.kubernetes

Kubernetes specification for tenant control plane

Name Type Description Required
kubelet object
true
version string Kubernetes Version for the tenant control plane
true
admissionControllers []enum List of enabled Admission Controllers for the Tenant cluster. Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers

Default: [CertificateApproval CertificateSigning CertificateSubjectRestriction DefaultIngressClass DefaultStorageClass DefaultTolerationSeconds LimitRanger MutatingAdmissionWebhook NamespaceLifecycle PersistentVolumeClaimResize Priority ResourceQuota RuntimeClass ServiceAccount StorageObjectInUseProtection TaintNodesByCondition ValidatingAdmissionWebhook]
false

TenantControlPlane.spec.kubernetes.kubelet

Name Type Description Required
cgroupfs enum CGroupFS defines the cgroup driver for Kubelet https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/

Enum: systemd, cgroupfs
false
preferredAddressTypes []enum Ordered list of the preferred NodeAddressTypes to use for kubelet connections. Default to Hostname, InternalIP, ExternalIP.

Default: [Hostname InternalIP ExternalIP]
false

TenantControlPlane.spec.addons

Addons contain which addons are enabled

Name Type Description Required
coreDNS object Enables the DNS addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `coredns`.
false
konnectivity object Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.
false
kubeProxy object Enables the kube-proxy addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.
false

TenantControlPlane.spec.addons.coreDNS

Enables the DNS addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to coredns.

Name Type Description Required
imageRepository string ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.
false
imageTag string ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
false

TenantControlPlane.spec.addons.konnectivity

Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.

Name Type Description Required
agent object

Default: map[image:registry.k8s.io/kas-network-proxy/proxy-agent version:v0.0.32]
false
server object

Default: map[image:registry.k8s.io/kas-network-proxy/proxy-server port:8132 version:v0.0.32]
false

TenantControlPlane.spec.addons.konnectivity.agent

Name Type Description Required
extraArgs []string ExtraArgs allows adding additional arguments to said component.
false
image string AgentImage defines the container image for Konnectivity's agent.

Default: registry.k8s.io/kas-network-proxy/proxy-agent
false
version string Version for Konnectivity agent.

Default: v0.0.32
false

TenantControlPlane.spec.addons.konnectivity.server

Name Type Description Required
port integer The port which Konnectivity server is listening to.

Format: int32
true
extraArgs []string ExtraArgs allows adding additional arguments to said component.
false
image string Container image used by the Konnectivity server.

Default: registry.k8s.io/kas-network-proxy/proxy-server
false
resources object Resources define the amount of CPU and memory to allocate to the Konnectivity server.
false
version string Container image version of the Konnectivity server.

Default: v0.0.32
false

TenantControlPlane.spec.addons.konnectivity.server.resources

Resources define the amount of CPU and memory to allocate to the Konnectivity server.

Name Type Description Required
limits map[string]int or string Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false
requests map[string]int or string Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
false

TenantControlPlane.spec.addons.kubeProxy

Enables the kube-proxy addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to kube-proxy.

Name Type Description Required
imageRepository string ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.
false
imageTag string ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.
false

TenantControlPlane.spec.networkProfile

NetworkProfile specifies how the network is

Name Type Description Required
address string Address where API server of will be exposed. In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.
false
allowAddressAsExternalIP boolean AllowAddressAsExternalIP will include tenantControlPlane.Spec.NetworkProfile.Address in the section of ExternalIPs of the Kubernetes Service (only ClusterIP or NodePort)
false
certSANs []string CertSANs sets extra Subject Alternative Names (SANs) for the API Server signing certificate. Use this field to add additional hostnames when exposing the Tenant Control Plane with third solutions.
false
dnsServiceIPs []string

Default: [10.96.0.10]
false
podCidr string CIDR for Kubernetes Pods

Default: 10.244.0.0/16
false
port integer Port where API server of will be exposed

Format: int32
Default: 6443
false
serviceCidr string Kubernetes Service

Default: 10.96.0.0/16
false

TenantControlPlane.status

TenantControlPlaneStatus defines the observed state of TenantControlPlane.

Name Type Description Required
addons object Addons contains the status of the different Addons
false
certificates object Certificates contains information about the different certificates that are necessary to run a kubernetes control plane
false
controlPlaneEndpoint string ControlPlaneEndpoint contains the status of the kubernetes control plane
false
kubeadmPhase object KubeadmPhase contains the status of the kubeadm phases action
false
kubeadmconfig object KubeadmConfig contains the status of the configuration required by kubeadm
false
kubeconfig object KubeConfig contains information about the kubenconfigs that control plane pieces need
false
kubernetesResources object Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster
false
storage object Storage Status contains information about Kubernetes storage system
false

TenantControlPlane.status.addons

Addons contains the status of the different Addons

Name Type Description Required
coreDNS object AddonStatus defines the observed state of an Addon.
false
konnectivity object KonnectivityStatus defines the status of Konnectivity as Addon.
false
kubeProxy object AddonStatus defines the observed state of an Addon.
false

TenantControlPlane.status.addons.coreDNS

AddonStatus defines the observed state of an Addon.

Name Type Description Required
enabled boolean
true
lastUpdate string

Format: date-time
false

TenantControlPlane.status.addons.konnectivity

KonnectivityStatus defines the status of Konnectivity as Addon.

Name Type Description Required
enabled boolean
true
agent object
false
certificate object CertificatePrivateKeyPairStatus defines the status.
false
clusterrolebinding object
false
configMap object
false
kubeconfig object KubeconfigStatus contains information about the generated kubeconfig.
false
sa object
false
service object KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.
false

TenantControlPlane.status.addons.konnectivity.agent

Name Type Description Required
lastUpdate string Last time when k8s object was updated

Format: date-time
false
name string
false
namespace string
false

TenantControlPlane.status.addons.konnectivity.certificate

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.addons.konnectivity.clusterrolebinding

Name Type Description Required
lastUpdate string Last time when k8s object was updated

Format: date-time
false
name string
false
namespace string
false

TenantControlPlane.status.addons.konnectivity.configMap

Name Type Description Required
checksum string
false
name string
false

TenantControlPlane.status.addons.konnectivity.kubeconfig

KubeconfigStatus contains information about the generated kubeconfig.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.addons.konnectivity.sa

Name Type Description Required
lastUpdate string Last time when k8s object was updated

Format: date-time
false
name string
false
namespace string
false

TenantControlPlane.status.addons.konnectivity.service

KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.

Name Type Description Required
name string The name of the Service for the given cluster.
true
namespace string The namespace which the Service for the given cluster is deployed.
true
port integer The port where the service is running

Format: int32
true
conditions []object Current service state
false
loadBalancer object LoadBalancer contains the current status of the load-balancer, if one is present.
false

TenantControlPlane.status.addons.konnectivity.service.conditions[index]

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

Name Type Description Required
lastTransitionTime string lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

Format: date-time
true
message string message is a human readable message indicating details about the transition. This may be an empty string.
true
reason string reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
true
status enum status of the condition, one of True, False, Unknown.

Enum: True, False, Unknown
true
type string type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
true
observedGeneration integer observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

Format: int64
Minimum: 0
false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer

LoadBalancer contains the current status of the load-balancer, if one is present.

Name Type Description Required
ingress []object Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer.ingress[index]

LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.

Name Type Description Required
hostname string Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
false
ip string IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
false
ports []object Ports is a list of records of service ports If used, every port defined in the service should have an entry in it
false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer.ingress[index].ports[index]

Name Type Description Required
port integer Port is the port number of the service port of which status is recorded here

Format: int32
true
protocol string Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP"

Default: TCP
true
error string Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
false

TenantControlPlane.status.addons.kubeProxy

AddonStatus defines the observed state of an Addon.

Name Type Description Required
enabled boolean
true
lastUpdate string

Format: date-time
false

TenantControlPlane.status.certificates

Certificates contains information about the different certificates that are necessary to run a kubernetes control plane

Name Type Description Required
apiServer object CertificatePrivateKeyPairStatus defines the status.
false
apiServerKubeletClient object CertificatePrivateKeyPairStatus defines the status.
false
ca object CertificatePrivateKeyPairStatus defines the status.
false
etcd object ETCDCertificatesStatus defines the observed state of ETCD Certificate for API server.
false
frontProxyCA object CertificatePrivateKeyPairStatus defines the status.
false
frontProxyClient object CertificatePrivateKeyPairStatus defines the status.
false
sa object PublicKeyPrivateKeyPairStatus defines the status.
false

TenantControlPlane.status.certificates.apiServer

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.apiServerKubeletClient

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.ca

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.etcd

ETCDCertificatesStatus defines the observed state of ETCD Certificate for API server.

Name Type Description Required
apiServer object APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.
false
ca object ETCDCertificateStatus defines the observed state of ETCD Certificate for API server.
false

TenantControlPlane.status.certificates.etcd.apiServer

APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.etcd.ca

ETCDCertificateStatus defines the observed state of ETCD Certificate for API server.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.frontProxyCA

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.frontProxyClient

CertificatePrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.certificates.sa

PublicKeyPrivateKeyPairStatus defines the status.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.kubeadmPhase

KubeadmPhase contains the status of the kubeadm phases action

Name Type Description Required
bootstrapToken object KubeadmPhaseStatus contains the status of a kubeadm phase action.
true

TenantControlPlane.status.kubeadmPhase.bootstrapToken

KubeadmPhaseStatus contains the status of a kubeadm phase action.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false

TenantControlPlane.status.kubeadmconfig

KubeadmConfig contains the status of the configuration required by kubeadm

Name Type Description Required
checksum string Checksum of the kubeadm configuration to detect changes
false
configmapName string
false
lastUpdate string

Format: date-time
false

TenantControlPlane.status.kubeconfig

KubeConfig contains information about the kubenconfigs that control plane pieces need

Name Type Description Required
admin object KubeconfigStatus contains information about the generated kubeconfig.
false
controllerManager object KubeconfigStatus contains information about the generated kubeconfig.
false
scheduler object KubeconfigStatus contains information about the generated kubeconfig.
false

TenantControlPlane.status.kubeconfig.admin

KubeconfigStatus contains information about the generated kubeconfig.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.kubeconfig.controllerManager

KubeconfigStatus contains information about the generated kubeconfig.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.kubeconfig.scheduler

KubeconfigStatus contains information about the generated kubeconfig.

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.kubernetesResources

Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster

Name Type Description Required
deployment object KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.
false
ingress object KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.
false
service object KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.
false
version object KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.
false

TenantControlPlane.status.kubernetesResources.deployment

KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.

Name Type Description Required
name string The name of the Deployment for the given cluster.
true
namespace string The namespace which the Deployment for the given cluster is deployed.
true
selector string Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.
true
availableReplicas integer Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.

Format: int32
false
collisionCount integer Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.

Format: int32
false
conditions []object Represents the latest available observations of a deployment's current state.
false
lastUpdate string Last time when deployment was updated

Format: date-time
false
observedGeneration integer The generation observed by the deployment controller.

Format: int64
false
readyReplicas integer readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.

Format: int32
false
replicas integer Total number of non-terminated pods targeted by this deployment (their labels match the selector).

Format: int32
false
unavailableReplicas integer Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.

Format: int32
false
updatedReplicas integer Total number of non-terminated pods targeted by this deployment that have the desired template spec.

Format: int32
false

TenantControlPlane.status.kubernetesResources.deployment.conditions[index]

DeploymentCondition describes the state of a deployment at a certain point.

Name Type Description Required
status string Status of the condition, one of True, False, Unknown.
true
type string Type of deployment condition.
true
lastTransitionTime string Last time the condition transitioned from one status to another.

Format: date-time
false
lastUpdateTime string The last time this condition was updated.

Format: date-time
false
message string A human readable message indicating details about the transition.
false
reason string The reason for the condition's last transition.
false

TenantControlPlane.status.kubernetesResources.ingress

KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.

Name Type Description Required
name string The name of the Ingress for the given cluster.
true
namespace string The namespace which the Ingress for the given cluster is deployed.
true
loadBalancer object LoadBalancer contains the current status of the load-balancer.
false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer

LoadBalancer contains the current status of the load-balancer.

Name Type Description Required
ingress []object Ingress is a list containing ingress points for the load-balancer.
false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer.ingress[index]

IngressLoadBalancerIngress represents the status of a load-balancer ingress point.

Name Type Description Required
hostname string Hostname is set for load-balancer ingress points that are DNS based.
false
ip string IP is set for load-balancer ingress points that are IP based.
false
ports []object Ports provides information about the ports exposed by this LoadBalancer.
false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer.ingress[index].ports[index]

IngressPortStatus represents the error condition of a service port

Name Type Description Required
port integer Port is the port number of the ingress port.

Format: int32
true
protocol string Protocol is the protocol of the ingress port. The supported values are: "TCP", "UDP", "SCTP"

Default: TCP
true
error string Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
false

TenantControlPlane.status.kubernetesResources.service

KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.

Name Type Description Required
name string The name of the Service for the given cluster.
true
namespace string The namespace which the Service for the given cluster is deployed.
true
port integer The port where the service is running

Format: int32
true
conditions []object Current service state
false
loadBalancer object LoadBalancer contains the current status of the load-balancer, if one is present.
false

TenantControlPlane.status.kubernetesResources.service.conditions[index]

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

Name Type Description Required
lastTransitionTime string lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

Format: date-time
true
message string message is a human readable message indicating details about the transition. This may be an empty string.
true
reason string reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
true
status enum status of the condition, one of True, False, Unknown.

Enum: True, False, Unknown
true
type string type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
true
observedGeneration integer observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

Format: int64
Minimum: 0
false

TenantControlPlane.status.kubernetesResources.service.loadBalancer

LoadBalancer contains the current status of the load-balancer, if one is present.

Name Type Description Required
ingress []object Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
false

TenantControlPlane.status.kubernetesResources.service.loadBalancer.ingress[index]

LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.

Name Type Description Required
hostname string Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
false
ip string IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
false
ports []object Ports is a list of records of service ports If used, every port defined in the service should have an entry in it
false

TenantControlPlane.status.kubernetesResources.service.loadBalancer.ingress[index].ports[index]

Name Type Description Required
port integer Port is the port number of the service port of which status is recorded here

Format: int32
true
protocol string Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP"

Default: TCP
true
error string Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
false

TenantControlPlane.status.kubernetesResources.version

KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.

Name Type Description Required
status enum Status returns the current status of the Kubernetes version, such as its provisioning state, or completed upgrade.

Enum: Provisioning, CertificateAuthorityRotating, Upgrading, Migrating, Ready, NotReady
Default: Provisioning
false
version string Version is the running Kubernetes version of the Tenant Control Plane.
false

TenantControlPlane.status.storage

Storage Status contains information about Kubernetes storage system

Name Type Description Required
certificate object
false
config object
false
dataStoreName string
false
driver string
false
setup object
false

TenantControlPlane.status.storage.certificate

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
secretName string
false

TenantControlPlane.status.storage.config

Name Type Description Required
checksum string
false
secretName string
false

TenantControlPlane.status.storage.setup

Name Type Description Required
checksum string
false
lastUpdate string

Format: date-time
false
schema string
false
user string
false