API Reference

Packages:

• kamaji.clastix.io/v1alpha1

kamaji.clastix.io/v1alpha1

Resource Types:

• DataStore

• TenantControlPlane

DataStore

DataStore is the Schema for the datastores API.

Name	Type	Description	Required
apiVersion	string	kamaji.clastix.io/v1alpha1	true
kind	string	DataStore	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	DataStoreSpec defines the desired state of DataStore.	false
status	object	DataStoreStatus defines the observed state of DataStore.	false

DataStore.spec

DataStoreSpec defines the desired state of DataStore.

Name	Type	Description	Required
driver	enum	The driver to use to connect to the shared datastore. Enum: etcd, MySQL, PostgreSQL	true
endpoints	[]string	List of the endpoints to connect to the shared datastore. No need for protocol, just bare IP/FQDN and port.	true
tlsConfig	object	Defines the TLS/SSL configuration required to connect to the data store in a secure way.	true
basicAuth	object	In case of authentication enabled for the given data store, specifies the username and password pair. This value is optional.	false

DataStore.spec.tlsConfig

Defines the TLS/SSL configuration required to connect to the data store in a secure way.

Name	Type	Description	Required
certificateAuthority	object	Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference. The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.	true
clientCertificate	object	Specifies the SSL/TLS key and private key pair used to connect to the data store.	true

DataStore.spec.tlsConfig.certificateAuthority

Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference. The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.

Name	Type	Description	Required
certificate	object		true
privateKey	object		false

DataStore.spec.tlsConfig.certificateAuthority.certificate

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.tlsConfig.certificateAuthority.certificate.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.spec.tlsConfig.certificateAuthority.privateKey

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.tlsConfig.certificateAuthority.privateKey.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.spec.tlsConfig.clientCertificate

Specifies the SSL/TLS key and private key pair used to connect to the data store.

Name	Type	Description	Required
certificate	object		true
privateKey	object		true

DataStore.spec.tlsConfig.clientCertificate.certificate

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.tlsConfig.clientCertificate.certificate.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.spec.tlsConfig.clientCertificate.privateKey

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.tlsConfig.clientCertificate.privateKey.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.spec.basicAuth

In case of authentication enabled for the given data store, specifies the username and password pair. This value is optional.

Name	Type	Description	Required
password	object		true
username	object		true

DataStore.spec.basicAuth.password

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.basicAuth.password.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.spec.basicAuth.username

Name	Type	Description	Required
content	string	Bare content of the file, base64 encoded. It has precedence over the SecretReference value. Format: byte	false
secretReference	object		false

DataStore.spec.basicAuth.username.secretReference

Name	Type	Description	Required
keyPath	string	Name of the key for the given Secret reference where the content is stored. This value is mandatory.	true
name	string	name is unique within a namespace to reference a secret resource.	false
namespace	string	namespace defines the space within which the secret name must be unique.	false

DataStore.status

DataStoreStatus defines the observed state of DataStore.

Name	Type	Description	Required
usedBy	[]string	List of the Tenant Control Planes, namespaced named, using this data store.	false

TenantControlPlane

TenantControlPlane is the Schema for the tenantcontrolplanes API.

Name	Type	Description	Required
apiVersion	string	kamaji.clastix.io/v1alpha1	true
kind	string	TenantControlPlane	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TenantControlPlaneSpec defines the desired state of TenantControlPlane.	false
status	object	TenantControlPlaneStatus defines the observed state of TenantControlPlane.	false

TenantControlPlane.spec

TenantControlPlaneSpec defines the desired state of TenantControlPlane.

Name	Type	Description	Required
controlPlane	object	ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster, such as the number of Pod replicas, the Service resource, or the Ingress.	true
kubernetes	object	Kubernetes specification for tenant control plane	true
addons	object	Addons contain which addons are enabled	false
dataStore	string	DataStore allows to specify a DataStore that should be used to store the Kubernetes data for the given Tenant Control Plane. This parameter is optional and acts as an override over the default one which is used by the Kamaji Operator. Migration from a different DataStore to another one is not yet supported and the reconciliation will be blocked.	false
networkProfile	object	NetworkProfile specifies how the network is	false

TenantControlPlane.spec.controlPlane

ControlPlane defines how the Tenant Control Plane Kubernetes resources must be created in the Admin Cluster, such as the number of Pod replicas, the Service resource, or the Ingress.

Name	Type	Description	Required
service	object	Defining the options for the Tenant Control Plane Service resource.	true
deployment	object	Defining the options for the deployed Tenant Control Plane as Deployment resource.	false
ingress	object	Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane	false

TenantControlPlane.spec.controlPlane.service

Defining the options for the Tenant Control Plane Service resource.

Name	Type	Description	Required
serviceType	enum	ServiceType allows specifying how to expose the Tenant Control Plane. Enum: ClusterIP, NodePort, LoadBalancer	true
additionalMetadata	object	AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.	false

TenantControlPlane.spec.controlPlane.service.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

TenantControlPlane.spec.controlPlane.deployment

Defining the options for the deployed Tenant Control Plane as Deployment resource.

Name	Type	Description	Required
additionalMetadata	object	AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.	false
affinity	object	If specified, the Tenant Control Plane pod's scheduling constraints. More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/	false
extraArgs	object	ExtraArgs allows adding additional arguments to the Control Plane components, such as kube-apiserver, controller-manager, and scheduler.	false
nodeSelector	map[string]string	NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/	false
replicas	integer	Format: int32 Default: 2	false
resources	object	Resources defines the amount of memory and CPU to allocate to each component of the Control Plane (kube-apiserver, controller-manager, and scheduler).	false
runtimeClassName	string	RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run the Tenant Control Plane pod. If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class	false
strategy	object	Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane. Default value is set to Rolling Update, with a blue/green strategy. Default: map[rollingUpdate:map[maxSurge:100% maxUnavailable:0] type:RollingUpdate]	false
tolerations	[]object	If specified, the Tenant Control Plane pod's tolerations. More info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/	false
topologySpreadConstraints	[]object	TopologySpreadConstraints describes how the Tenant Control Plane pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. In case of nil underlying LabelSelector, the Kamaji one for the given Tenant Control Plane will be used. All topologySpreadConstraints are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

TenantControlPlane.spec.controlPlane.deployment.affinity

If specified, the Tenant Control Plane pod's scheduling constraints. More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

A label query over a set of resources, in this case pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

A label query over a set of resources, in this case pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.deployment.extraArgs

ExtraArgs allows adding additional arguments to the Control Plane components, such as kube-apiserver, controller-manager, and scheduler.

Name	Type	Description	Required
apiServer	[]string		false
controllerManager	[]string		false
kine	[]string	Available only if Kamaji is running using Kine as backing storage.	false
scheduler	[]string		false

TenantControlPlane.spec.controlPlane.deployment.resources

Resources defines the amount of memory and CPU to allocate to each component of the Control Plane (kube-apiserver, controller-manager, and scheduler).

Name	Type	Description	Required
apiServer	object	ComponentResourceRequirements describes the compute resource requirements.	false
controllerManager	object	ComponentResourceRequirements describes the compute resource requirements.	false
scheduler	object	ComponentResourceRequirements describes the compute resource requirements.	false

TenantControlPlane.spec.controlPlane.deployment.resources.apiServer

ComponentResourceRequirements describes the compute resource requirements.

Name	Type	Description	Required
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

TenantControlPlane.spec.controlPlane.deployment.resources.controllerManager

ComponentResourceRequirements describes the compute resource requirements.

Name	Type	Description	Required
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

TenantControlPlane.spec.controlPlane.deployment.resources.scheduler

ComponentResourceRequirements describes the compute resource requirements.

Name	Type	Description	Required
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

TenantControlPlane.spec.controlPlane.deployment.strategy

Strategy describes how to replace existing pods with new ones for the given Tenant Control Plane. Default value is set to Rolling Update, with a blue/green strategy.

Name	Type	Description	Required
rollingUpdate	object	Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. --- TODO: Update this to follow our convention for oneOf, whatever we decide it to be.	false
type	string	Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.	false

TenantControlPlane.spec.controlPlane.deployment.strategy.rollingUpdate

Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate. --- TODO: Update this to follow our convention for oneOf, whatever we decide it to be.

Name	Type	Description	Required
maxSurge	int or string	The maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods.	false
maxUnavailable	int or string	The maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods.	false

TenantControlPlane.spec.controlPlane.deployment.tolerations[index]

The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index]

TopologySpreadConstraint specifies how to spread matching pods among the given topology.

Name	Type	Description	Required
maxSkew	integer	MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed. Format: int32	true
topologyKey	string	TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field.	true
whenUnsatisfiable	string	WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.	true
labelSelector	object	LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.	false
minDomains	integer	MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). Format: int32	false
nodeAffinityPolicy	string	NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.	false
nodeTaintsPolicy	string	NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.	false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index].labelSelector

LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

TenantControlPlane.spec.controlPlane.deployment.topologySpreadConstraints[index].labelSelector.matchExpressions[index]

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

TenantControlPlane.spec.controlPlane.ingress

Defining the options for an Optional Ingress which will expose API Server of the Tenant Control Plane

Name	Type	Description	Required
additionalMetadata	object	AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.	false
hostname	string	Hostname is an optional field which will be used as Ingress's Host. If it is not defined, Ingress's host will be "..", where domain is specified under NetworkProfileSpec	false
ingressClassName	string		false

TenantControlPlane.spec.controlPlane.ingress.additionalMetadata

AdditionalMetadata defines which additional metadata, such as labels and annotations, must be attached to the created resource.

Name	Type	Description	Required
annotations	map[string]string		false
labels	map[string]string		false

TenantControlPlane.spec.kubernetes

Kubernetes specification for tenant control plane

Name	Type	Description	Required
kubelet	object		true
version	string	Kubernetes Version for the tenant control plane	true
admissionControllers	[]enum	List of enabled Admission Controllers for the Tenant cluster. Full reference available here: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers Default: [CertificateApproval CertificateSigning CertificateSubjectRestriction DefaultIngressClass DefaultStorageClass DefaultTolerationSeconds LimitRanger MutatingAdmissionWebhook NamespaceLifecycle PersistentVolumeClaimResize Priority ResourceQuota RuntimeClass ServiceAccount StorageObjectInUseProtection TaintNodesByCondition ValidatingAdmissionWebhook]	false

TenantControlPlane.spec.kubernetes.kubelet

Name	Type	Description	Required
cgroupfs	enum	CGroupFS defines the cgroup driver for Kubelet https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/configure-cgroup-driver/ Enum: systemd, cgroupfs	false
preferredAddressTypes	[]enum	Ordered list of the preferred NodeAddressTypes to use for kubelet connections. Default to Hostname, InternalIP, ExternalIP. Default: [Hostname InternalIP ExternalIP]	false

TenantControlPlane.spec.addons

Addons contain which addons are enabled

Name	Type	Description	Required
coreDNS	object	Enables the DNS addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `coredns`.	false
konnectivity	object	Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.	false
kubeProxy	object	Enables the kube-proxy addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to `kube-proxy`.	false

TenantControlPlane.spec.addons.coreDNS

Enables the DNS addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to coredns.

Name	Type	Description	Required
imageRepository	string	ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.	false
imageTag	string	ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.	false

TenantControlPlane.spec.addons.konnectivity

Enables the Konnectivity addon in the Tenant Cluster, required if the worker nodes are in a different network.

Name	Type	Description	Required
agent	object	Default: map[image:registry.k8s.io/kas-network-proxy/proxy-agent version:v0.0.32]	false
server	object	Default: map[image:registry.k8s.io/kas-network-proxy/proxy-server port:8132 version:v0.0.32]	false

TenantControlPlane.spec.addons.konnectivity.agent

Name	Type	Description	Required
extraArgs	[]string	ExtraArgs allows adding additional arguments to said component.	false
image	string	AgentImage defines the container image for Konnectivity's agent. Default: registry.k8s.io/kas-network-proxy/proxy-agent	false
version	string	Version for Konnectivity agent. Default: v0.0.32	false

TenantControlPlane.spec.addons.konnectivity.server

Name	Type	Description	Required
port	integer	The port which Konnectivity server is listening to. Format: int32	true
extraArgs	[]string	ExtraArgs allows adding additional arguments to said component.	false
image	string	Container image used by the Konnectivity server. Default: registry.k8s.io/kas-network-proxy/proxy-server	false
resources	object	Resources define the amount of CPU and memory to allocate to the Konnectivity server.	false
version	string	Container image version of the Konnectivity server. Default: v0.0.32	false

TenantControlPlane.spec.addons.konnectivity.server.resources

Resources define the amount of CPU and memory to allocate to the Konnectivity server.

Name	Type	Description	Required
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

TenantControlPlane.spec.addons.kubeProxy

Enables the kube-proxy addon in the Tenant Cluster. The registry and the tag are configurable, the image is hard-coded to kube-proxy.

Name	Type	Description	Required
imageRepository	string	ImageRepository sets the container registry to pull images from. if not set, the default ImageRepository will be used instead.	false
imageTag	string	ImageTag allows to specify a tag for the image. In case this value is set, kubeadm does not change automatically the version of the above components during upgrades.	false

TenantControlPlane.spec.networkProfile

NetworkProfile specifies how the network is

Name	Type	Description	Required
address	string	Address where API server of will be exposed. In case of LoadBalancer Service, this can be empty in order to use the exposed IP provided by the cloud controller manager.	false
allowAddressAsExternalIP	boolean	AllowAddressAsExternalIP will include tenantControlPlane.Spec.NetworkProfile.Address in the section of ExternalIPs of the Kubernetes Service (only ClusterIP or NodePort)	false
certSANs	[]string	CertSANs sets extra Subject Alternative Names (SANs) for the API Server signing certificate. Use this field to add additional hostnames when exposing the Tenant Control Plane with third solutions.	false
dnsServiceIPs	[]string	Default: [10.96.0.10]	false
podCidr	string	CIDR for Kubernetes Pods Default: 10.244.0.0/16	false
port	integer	Port where API server of will be exposed Format: int32 Default: 6443	false
serviceCidr	string	Kubernetes Service Default: 10.96.0.0/16	false

TenantControlPlane.status

TenantControlPlaneStatus defines the observed state of TenantControlPlane.

Name	Type	Description	Required
addons	object	Addons contains the status of the different Addons	false
certificates	object	Certificates contains information about the different certificates that are necessary to run a kubernetes control plane	false
controlPlaneEndpoint	string	ControlPlaneEndpoint contains the status of the kubernetes control plane	false
kubeadmPhase	object	KubeadmPhase contains the status of the kubeadm phases action	false
kubeadmconfig	object	KubeadmConfig contains the status of the configuration required by kubeadm	false
kubeconfig	object	KubeConfig contains information about the kubenconfigs that control plane pieces need	false
kubernetesResources	object	Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster	false
storage	object	Storage Status contains information about Kubernetes storage system	false

TenantControlPlane.status.addons

Addons contains the status of the different Addons

Name	Type	Description	Required
coreDNS	object	AddonStatus defines the observed state of an Addon.	false
konnectivity	object	KonnectivityStatus defines the status of Konnectivity as Addon.	false
kubeProxy	object	AddonStatus defines the observed state of an Addon.	false

TenantControlPlane.status.addons.coreDNS

AddonStatus defines the observed state of an Addon.

Name	Type	Description	Required
enabled	boolean		true
lastUpdate	string	Format: date-time	false

TenantControlPlane.status.addons.konnectivity

KonnectivityStatus defines the status of Konnectivity as Addon.

Name	Type	Description	Required
enabled	boolean		true
agent	object		false
certificate	object	CertificatePrivateKeyPairStatus defines the status.	false
clusterrolebinding	object		false
configMap	object		false
kubeconfig	object	KubeconfigStatus contains information about the generated kubeconfig.	false
sa	object		false
service	object	KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.	false

TenantControlPlane.status.addons.konnectivity.agent

Name	Type	Description	Required
lastUpdate	string	Last time when k8s object was updated Format: date-time	false
name	string		false
namespace	string		false

TenantControlPlane.status.addons.konnectivity.certificate

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.addons.konnectivity.clusterrolebinding

Name	Type	Description	Required
lastUpdate	string	Last time when k8s object was updated Format: date-time	false
name	string		false
namespace	string		false

TenantControlPlane.status.addons.konnectivity.configMap

Name	Type	Description	Required
checksum	string		false
name	string		false

TenantControlPlane.status.addons.konnectivity.kubeconfig

KubeconfigStatus contains information about the generated kubeconfig.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.addons.konnectivity.sa

Name	Type	Description	Required
lastUpdate	string	Last time when k8s object was updated Format: date-time	false
name	string		false
namespace	string		false

TenantControlPlane.status.addons.konnectivity.service

KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.

Name	Type	Description	Required
name	string	The name of the Service for the given cluster.	true
namespace	string	The namespace which the Service for the given cluster is deployed.	true
port	integer	The port where the service is running Format: int32	true
conditions	[]object	Current service state	false
loadBalancer	object	LoadBalancer contains the current status of the load-balancer, if one is present.	false

TenantControlPlane.status.addons.konnectivity.service.conditions[index]

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer

LoadBalancer contains the current status of the load-balancer, if one is present.

Name	Type	Description	Required
ingress	[]object	Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.	false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer.ingress[index]

LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.

Name	Type	Description	Required
hostname	string	Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)	false
ip	string	IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)	false
ports	[]object	Ports is a list of records of service ports If used, every port defined in the service should have an entry in it	false

TenantControlPlane.status.addons.konnectivity.service.loadBalancer.ingress[index].ports[index]

Name	Type	Description	Required
port	integer	Port is the port number of the service port of which status is recorded here Format: int32	true
protocol	string	Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP" Default: TCP	true
error	string	Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)	false

TenantControlPlane.status.addons.kubeProxy

AddonStatus defines the observed state of an Addon.

Name	Type	Description	Required
enabled	boolean		true
lastUpdate	string	Format: date-time	false

TenantControlPlane.status.certificates

Certificates contains information about the different certificates that are necessary to run a kubernetes control plane

Name	Type	Description	Required
apiServer	object	CertificatePrivateKeyPairStatus defines the status.	false
apiServerKubeletClient	object	CertificatePrivateKeyPairStatus defines the status.	false
ca	object	CertificatePrivateKeyPairStatus defines the status.	false
etcd	object	ETCDCertificatesStatus defines the observed state of ETCD Certificate for API server.	false
frontProxyCA	object	CertificatePrivateKeyPairStatus defines the status.	false
frontProxyClient	object	CertificatePrivateKeyPairStatus defines the status.	false
sa	object	PublicKeyPrivateKeyPairStatus defines the status.	false

TenantControlPlane.status.certificates.apiServer

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.apiServerKubeletClient

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.ca

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.etcd

ETCDCertificatesStatus defines the observed state of ETCD Certificate for API server.

Name	Type	Description	Required
apiServer	object	APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.	false
ca	object	ETCDCertificateStatus defines the observed state of ETCD Certificate for API server.	false

TenantControlPlane.status.certificates.etcd.apiServer

APIServerCertificatesStatus defines the observed state of ETCD Certificate for API server.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.etcd.ca

ETCDCertificateStatus defines the observed state of ETCD Certificate for API server.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.frontProxyCA

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.frontProxyClient

CertificatePrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.certificates.sa

PublicKeyPrivateKeyPairStatus defines the status.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.kubeadmPhase

KubeadmPhase contains the status of the kubeadm phases action

Name	Type	Description	Required
bootstrapToken	object	KubeadmPhaseStatus contains the status of a kubeadm phase action.	true

TenantControlPlane.status.kubeadmPhase.bootstrapToken

KubeadmPhaseStatus contains the status of a kubeadm phase action.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false

TenantControlPlane.status.kubeadmconfig

KubeadmConfig contains the status of the configuration required by kubeadm

Name	Type	Description	Required
checksum	string	Checksum of the kubeadm configuration to detect changes	false
configmapName	string		false
lastUpdate	string	Format: date-time	false

TenantControlPlane.status.kubeconfig

KubeConfig contains information about the kubenconfigs that control plane pieces need

Name	Type	Description	Required
admin	object	KubeconfigStatus contains information about the generated kubeconfig.	false
controllerManager	object	KubeconfigStatus contains information about the generated kubeconfig.	false
scheduler	object	KubeconfigStatus contains information about the generated kubeconfig.	false

TenantControlPlane.status.kubeconfig.admin

KubeconfigStatus contains information about the generated kubeconfig.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.kubeconfig.controllerManager

KubeconfigStatus contains information about the generated kubeconfig.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.kubeconfig.scheduler

KubeconfigStatus contains information about the generated kubeconfig.

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.kubernetesResources

Kubernetes contains information about the reconciliation of the required Kubernetes resources deployed in the admin cluster

Name	Type	Description	Required
deployment	object	KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.	false
ingress	object	KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.	false
service	object	KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.	false
version	object	KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.	false

TenantControlPlane.status.kubernetesResources.deployment

KubernetesDeploymentStatus defines the status for the Tenant Control Plane Deployment in the management cluster.

Name	Type	Description	Required
name	string	The name of the Deployment for the given cluster.	true
namespace	string	The namespace which the Deployment for the given cluster is deployed.	true
selector	string	Selector is the label selector used to group the Tenant Control Plane Pods used by the scale subresource.	true
availableReplicas	integer	Total number of available pods (ready for at least minReadySeconds) targeted by this deployment. Format: int32	false
collisionCount	integer	Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet. Format: int32	false
conditions	[]object	Represents the latest available observations of a deployment's current state.	false
lastUpdate	string	Last time when deployment was updated Format: date-time	false
observedGeneration	integer	The generation observed by the deployment controller. Format: int64	false
readyReplicas	integer	readyReplicas is the number of pods targeted by this Deployment with a Ready Condition. Format: int32	false
replicas	integer	Total number of non-terminated pods targeted by this deployment (their labels match the selector). Format: int32	false
unavailableReplicas	integer	Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created. Format: int32	false
updatedReplicas	integer	Total number of non-terminated pods targeted by this deployment that have the desired template spec. Format: int32	false

TenantControlPlane.status.kubernetesResources.deployment.conditions[index]

DeploymentCondition describes the state of a deployment at a certain point.

Name	Type	Description	Required
status	string	Status of the condition, one of True, False, Unknown.	true
type	string	Type of deployment condition.	true
lastTransitionTime	string	Last time the condition transitioned from one status to another. Format: date-time	false
lastUpdateTime	string	The last time this condition was updated. Format: date-time	false
message	string	A human readable message indicating details about the transition.	false
reason	string	The reason for the condition's last transition.	false

TenantControlPlane.status.kubernetesResources.ingress

KubernetesIngressStatus defines the status for the Tenant Control Plane Ingress in the management cluster.

Name	Type	Description	Required
name	string	The name of the Ingress for the given cluster.	true
namespace	string	The namespace which the Ingress for the given cluster is deployed.	true
loadBalancer	object	LoadBalancer contains the current status of the load-balancer.	false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer

LoadBalancer contains the current status of the load-balancer.

Name	Type	Description	Required
ingress	[]object	Ingress is a list containing ingress points for the load-balancer.	false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer.ingress[index]

IngressLoadBalancerIngress represents the status of a load-balancer ingress point.

Name	Type	Description	Required
hostname	string	Hostname is set for load-balancer ingress points that are DNS based.	false
ip	string	IP is set for load-balancer ingress points that are IP based.	false
ports	[]object	Ports provides information about the ports exposed by this LoadBalancer.	false

TenantControlPlane.status.kubernetesResources.ingress.loadBalancer.ingress[index].ports[index]

IngressPortStatus represents the error condition of a service port

Name	Type	Description	Required
port	integer	Port is the port number of the ingress port. Format: int32	true
protocol	string	Protocol is the protocol of the ingress port. The supported values are: "TCP", "UDP", "SCTP" Default: TCP	true
error	string	Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)	false

TenantControlPlane.status.kubernetesResources.service

KubernetesServiceStatus defines the status for the Tenant Control Plane Service in the management cluster.

Name	Type	Description	Required
name	string	The name of the Service for the given cluster.	true
namespace	string	The namespace which the Service for the given cluster is deployed.	true
port	integer	The port where the service is running Format: int32	true
conditions	[]object	Current service state	false
loadBalancer	object	LoadBalancer contains the current status of the load-balancer, if one is present.	false

TenantControlPlane.status.kubernetesResources.service.conditions[index]

Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, type FooStatus struct{ // Represents the observations of a foo's current state. // Known .status.conditions.type are: "Available", "Progressing", and "Degraded" // +patchMergeKey=type // +patchStrategy=merge // +listType=map // +listMapKey=type Conditions []metav1.Condition json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions" // other fields }

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

TenantControlPlane.status.kubernetesResources.service.loadBalancer

LoadBalancer contains the current status of the load-balancer, if one is present.

Name	Type	Description	Required
ingress	[]object	Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.	false

TenantControlPlane.status.kubernetesResources.service.loadBalancer.ingress[index]

LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.

Name	Type	Description	Required
hostname	string	Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)	false
ip	string	IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)	false
ports	[]object	Ports is a list of records of service ports If used, every port defined in the service should have an entry in it	false

TenantControlPlane.status.kubernetesResources.service.loadBalancer.ingress[index].ports[index]

Name	Type	Description	Required
port	integer	Port is the port number of the service port of which status is recorded here Format: int32	true
protocol	string	Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP" Default: TCP	true
error	string	Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase. --- The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)	false

TenantControlPlane.status.kubernetesResources.version

KubernetesVersion contains the information regarding the running Kubernetes version, and its upgrade status.

Name	Type	Description	Required
status	enum	Status returns the current status of the Kubernetes version, such as its provisioning state, or completed upgrade. Enum: Provisioning, CertificateAuthorityRotating, Upgrading, Migrating, Ready, NotReady Default: Provisioning	false
version	string	Version is the running Kubernetes version of the Tenant Control Plane.	false

TenantControlPlane.status.storage

Storage Status contains information about Kubernetes storage system

Name	Type	Description	Required
certificate	object		false
config	object		false
dataStoreName	string		false
driver	string		false
setup	object		false

TenantControlPlane.status.storage.certificate

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
secretName	string		false

TenantControlPlane.status.storage.config

Name	Type	Description	Required
checksum	string		false
secretName	string		false

TenantControlPlane.status.storage.setup

Name	Type	Description	Required
checksum	string		false
lastUpdate	string	Format: date-time	false
schema	string		false
user	string		false