| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -tailscale.com/v1alpha1 | -true | -
| kind | -string | -Connector | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- ConnectorSpec describes the desired Tailscale component.
-More info:
-https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - - Validations: |
- true | -
| status | -object | -
- ConnectorStatus describes the status of the Connector. This is set
-and managed by the Tailscale operator. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| exitNode | -boolean | -
- ExitNode defines whether the Connector node should act as a
-Tailscale exit node. Defaults to false.
-https://tailscale.com/kb/1103/exit-nodes - |
- false | -
| hostname | -string | -
- Hostname is the tailnet hostname that should be assigned to the
-Connector node. If unset, hostname defaults to - |
- false | -
| proxyClass | -string | -
- ProxyClass is the name of the ProxyClass custom resource that
-contains configuration options that should be applied to the
-resources created for this Connector. If unset, the operator will
-create resources with the default configuration. - |
- false | -
| subnetRouter | -object | -
- SubnetRouter defines subnet routes that the Connector node should
-expose to tailnet. If unset, none are exposed.
-https://tailscale.com/kb/1019/subnets/ - |
- false | -
| tags | -[]string | -
- Tags that the Tailscale node will be tagged with.
-Defaults to [tag:k8s].
-To autoapprove the subnet routes or exit node defined by a Connector,
-you can configure Tailscale ACLs to give these tags the necessary
-permissions.
-See https://tailscale.com/kb/1018/acls/#auto-approvers-for-routes-and-exit-nodes.
-If you specify custom tags here, you must also make the operator an owner of these tags.
-See https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
-Tags cannot be changed once a Connector node has been created.
-Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| advertiseRoutes | -[]string | -
- AdvertiseRoutes refer to CIDRs that the subnet router should make
-available. Route values must be strings that represent a valid IPv4
-or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes.
-https://tailscale.com/kb/1201/4via6-subnets/ - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- List of status conditions to indicate the status of the Connector.
-Known condition types are `ConnectorReady`. - |
- false | -
| hostname | -string | -
- Hostname is the fully qualified domain name of the Connector node.
-If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
-node. - |
- false | -
| isExitNode | -boolean | -
- IsExitNode is set to true if the Connector acts as an exit node. - |
- false | -
| subnetRoutes | -string | -
- SubnetRoutes are the routes currently exposed to tailnet via this
-Connector instance. - |
- false | -
| tailnetIPs | -[]string | -
- TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
-assigned to the Connector node. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -tailscale.com/v1alpha1 | -true | -
| kind | -string | -DNSConfig | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- Spec describes the desired DNS configuration.
-More info:
-https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - |
- true | -
| status | -object | -
- Status describes the status of the DNSConfig. This is set
-and managed by the Tailscale operator. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| nameserver | -object | -
- Configuration for a nameserver that can resolve ts.net DNS names
-associated with in-cluster proxies for Tailscale egress Services and
-Tailscale Ingresses. The operator will always deploy this nameserver
-when a DNSConfig is applied. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| image | -object | -
- Nameserver image. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| repo | -string | -
- Repo defaults to tailscale/k8s-nameserver. - |
- false | -
| tag | -string | -
- Tag defaults to operator's own tag. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- - |
- false | -
| nameserver | -object | -
- Nameserver describes the status of nameserver cluster resources. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| ip | -string | -
- IP is the ClusterIP of the Service fronting the deployed ts.net nameserver.
-Currently you must manually update your cluster DNS config to add
-this address as a stub nameserver for ts.net for cluster workloads to be
-able to resolve MagicDNS names associated with egress or Ingress
-proxies.
-The IP address will change if you delete and recreate the DNSConfig. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -tailscale.com/v1alpha1 | -true | -
| kind | -string | -ProxyClass | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- Specification of the desired state of the ProxyClass resource.
-https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - |
- true | -
| status | -object | -
- Status of the ProxyClass. This is set and managed automatically.
-https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| metrics | -object | -
- Configuration for proxy metrics. Metrics are currently not supported
-for egress proxies and for Ingress proxies that have been configured
-with tailscale.com/experimental-forward-cluster-traffic-via-ingress
-annotation. Note that the metrics are currently considered unstable
-and will likely change in breaking ways in the future - we only
-recommend that you use those for debugging purposes. - |
- false | -
| statefulSet | -object | -
- Configuration parameters for the proxy's StatefulSet. Tailscale
-Kubernetes operator deploys a StatefulSet for each of the user
-configured proxies (Tailscale Ingress, Tailscale Service, Connector). - |
- false | -
| tailscale | -object | -
- TailscaleConfig contains options to configure the tailscale-specific
-parameters of proxies. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| enable | -boolean | -
- Setting enable to true will make the proxy serve Tailscale metrics
-at - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| annotations | -map[string]string | -
- Annotations that will be added to the StatefulSet created for the proxy.
-Any Annotations specified here will be merged with the default annotations
-applied to the StatefulSet by the Tailscale Kubernetes operator as
-well as any other annotations that might have been applied by other
-actors.
-Annotations must be valid Kubernetes annotations.
-https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set - |
- false | -
| labels | -map[string]string | -
- Labels that will be added to the StatefulSet created for the proxy.
-Any labels specified here will be merged with the default labels
-applied to the StatefulSet by the Tailscale Kubernetes operator as
-well as any other labels that might have been applied by other
-actors.
-Label keys and values must be valid Kubernetes label keys and values.
-https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set - |
- false | -
| pod | -object | -
- Configuration for the proxy Pod. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| affinity | -object | -
- Proxy Pod's affinity rules.
-By default, the Tailscale Kubernetes operator does not apply any affinity rules.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity - |
- false | -
| annotations | -map[string]string | -
- Annotations that will be added to the proxy Pod.
-Any annotations specified here will be merged with the default
-annotations applied to the Pod by the Tailscale Kubernetes operator.
-Annotations must be valid Kubernetes annotations.
-https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set - |
- false | -
| imagePullSecrets | -[]object | -
- Proxy Pod's image pull Secrets.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec - |
- false | -
| labels | -map[string]string | -
- Labels that will be added to the proxy Pod.
-Any labels specified here will be merged with the default labels
-applied to the Pod by the Tailscale Kubernetes operator.
-Label keys and values must be valid Kubernetes label keys and values.
-https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set - |
- false | -
| nodeName | -string | -
- Proxy Pod's node name.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling - |
- false | -
| nodeSelector | -map[string]string | -
- Proxy Pod's node selector.
-By default Tailscale Kubernetes operator does not apply any node
-selector.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling - |
- false | -
| securityContext | -object | -
- Proxy Pod's security context.
-By default Tailscale Kubernetes operator does not apply any Pod
-security context.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2 - |
- false | -
| tailscaleContainer | -object | -
- Configuration for the proxy container running tailscale. - |
- false | -
| tailscaleInitContainer | -object | -
- Configuration for the proxy init container that enables forwarding. - |
- false | -
| tolerations | -[]object | -
- Proxy Pod's tolerations.
-By default Tailscale Kubernetes operator does not apply any
-tolerations.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| nodeAffinity | -object | -
- Describes node affinity scheduling rules for the pod. - |
- false | -
| podAffinity | -object | -
- Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - |
- false | -
| podAntiAffinity | -object | -
- Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | -[]object | -
- The scheduler will prefer to schedule pods to nodes that satisfy
-the affinity expressions specified by this field, but it may choose
-a node that violates one or more of the expressions. The node that is
-most preferred is the one with the greatest sum of weights, i.e.
-for each node that meets all of the scheduling requirements (resource
-request, requiredDuringScheduling affinity expressions, etc.),
-compute a sum by iterating through the elements of this field and adding
-"weight" to the sum if the node matches the corresponding matchExpressions; the
-node(s) with the highest sum are the most preferred. - |
- false | -
| requiredDuringSchedulingIgnoredDuringExecution | -object | -
- If the affinity requirements specified by this field are not met at
-scheduling time, the pod will not be scheduled onto the node.
-If the affinity requirements specified by this field cease to be met
-at some point during pod execution (e.g. due to an update), the system
-may or may not try to eventually evict the pod from its node. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| preference | -object | -
- A node selector term, associated with the corresponding weight. - |
- true | -
| weight | -integer | -
- Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - - Format: int32 - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- A list of node selector requirements by node's labels. - |
- false | -
| matchFields | -[]object | -
- A list of node selector requirements by node's fields. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- The label key that the selector applies to. - |
- true | -
| operator | -string | -
- Represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - |
- true | -
| values | -[]string | -
- An array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. If the operator is Gt or Lt, the values
-array must have a single element, which will be interpreted as an integer.
-This array is replaced during a strategic merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- The label key that the selector applies to. - |
- true | -
| operator | -string | -
- Represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - |
- true | -
| values | -[]string | -
- An array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. If the operator is Gt or Lt, the values
-array must have a single element, which will be interpreted as an integer.
-This array is replaced during a strategic merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| nodeSelectorTerms | -[]object | -
- Required. A list of node selector terms. The terms are ORed. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- A list of node selector requirements by node's labels. - |
- false | -
| matchFields | -[]object | -
- A list of node selector requirements by node's fields. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- The label key that the selector applies to. - |
- true | -
| operator | -string | -
- Represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - |
- true | -
| values | -[]string | -
- An array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. If the operator is Gt or Lt, the values
-array must have a single element, which will be interpreted as an integer.
-This array is replaced during a strategic merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- The label key that the selector applies to. - |
- true | -
| operator | -string | -
- Represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - |
- true | -
| values | -[]string | -
- An array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. If the operator is Gt or Lt, the values
-array must have a single element, which will be interpreted as an integer.
-This array is replaced during a strategic merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | -[]object | -
- The scheduler will prefer to schedule pods to nodes that satisfy
-the affinity expressions specified by this field, but it may choose
-a node that violates one or more of the expressions. The node that is
-most preferred is the one with the greatest sum of weights, i.e.
-for each node that meets all of the scheduling requirements (resource
-request, requiredDuringScheduling affinity expressions, etc.),
-compute a sum by iterating through the elements of this field and adding
-"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-node(s) with the highest sum are the most preferred. - |
- false | -
| requiredDuringSchedulingIgnoredDuringExecution | -[]object | -
- If the affinity requirements specified by this field are not met at
-scheduling time, the pod will not be scheduled onto the node.
-If the affinity requirements specified by this field cease to be met
-at some point during pod execution (e.g. due to a pod label update), the
-system may or may not try to eventually evict the pod from its node.
-When there are multiple elements, the lists of nodes corresponding to each
-podAffinityTerm are intersected, i.e. all terms must be satisfied. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| podAffinityTerm | -object | -
- Required. A pod affinity term, associated with the corresponding weight. - |
- true | -
| weight | -integer | -
- weight associated with matching the corresponding podAffinityTerm,
-in the range 1-100. - - Format: int32 - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| topologyKey | -string | -
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-the labelSelector in the specified namespaces, where co-located is defined as running on a node
-whose value of the label with key topologyKey matches that of any node on which any of the
-selected pods is running.
-Empty topologyKey is not allowed. - |
- true | -
| labelSelector | -object | -
- A label query over a set of resources, in this case pods.
-If it's null, this PodAffinityTerm matches with no Pods. - |
- false | -
| matchLabelKeys | -[]string | -
- MatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-Also, matchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| mismatchLabelKeys | -[]string | -
- MismatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| namespaceSelector | -object | -
- A label query over the set of namespaces that the term applies to.
-The term is applied to the union of the namespaces selected by this field
-and the ones listed in the namespaces field.
-null selector and null or empty namespaces list means "this pod's namespace".
-An empty selector ({}) matches all namespaces. - |
- false | -
| namespaces | -[]string | -
- namespaces specifies a static list of namespace names that the term applies to.
-The term is applied to the union of the namespaces listed in this field
-and the ones selected by namespaceSelector.
-null or empty namespaces list and null namespaceSelector means "this pod's namespace". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| topologyKey | -string | -
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-the labelSelector in the specified namespaces, where co-located is defined as running on a node
-whose value of the label with key topologyKey matches that of any node on which any of the
-selected pods is running.
-Empty topologyKey is not allowed. - |
- true | -
| labelSelector | -object | -
- A label query over a set of resources, in this case pods.
-If it's null, this PodAffinityTerm matches with no Pods. - |
- false | -
| matchLabelKeys | -[]string | -
- MatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-Also, matchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| mismatchLabelKeys | -[]string | -
- MismatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| namespaceSelector | -object | -
- A label query over the set of namespaces that the term applies to.
-The term is applied to the union of the namespaces selected by this field
-and the ones listed in the namespaces field.
-null selector and null or empty namespaces list means "this pod's namespace".
-An empty selector ({}) matches all namespaces. - |
- false | -
| namespaces | -[]string | -
- namespaces specifies a static list of namespace names that the term applies to.
-The term is applied to the union of the namespaces listed in this field
-and the ones selected by namespaceSelector.
-null or empty namespaces list and null namespaceSelector means "this pod's namespace". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | -[]object | -
- The scheduler will prefer to schedule pods to nodes that satisfy
-the anti-affinity expressions specified by this field, but it may choose
-a node that violates one or more of the expressions. The node that is
-most preferred is the one with the greatest sum of weights, i.e.
-for each node that meets all of the scheduling requirements (resource
-request, requiredDuringScheduling anti-affinity expressions, etc.),
-compute a sum by iterating through the elements of this field and adding
-"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
-node(s) with the highest sum are the most preferred. - |
- false | -
| requiredDuringSchedulingIgnoredDuringExecution | -[]object | -
- If the anti-affinity requirements specified by this field are not met at
-scheduling time, the pod will not be scheduled onto the node.
-If the anti-affinity requirements specified by this field cease to be met
-at some point during pod execution (e.g. due to a pod label update), the
-system may or may not try to eventually evict the pod from its node.
-When there are multiple elements, the lists of nodes corresponding to each
-podAffinityTerm are intersected, i.e. all terms must be satisfied. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| podAffinityTerm | -object | -
- Required. A pod affinity term, associated with the corresponding weight. - |
- true | -
| weight | -integer | -
- weight associated with matching the corresponding podAffinityTerm,
-in the range 1-100. - - Format: int32 - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| topologyKey | -string | -
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-the labelSelector in the specified namespaces, where co-located is defined as running on a node
-whose value of the label with key topologyKey matches that of any node on which any of the
-selected pods is running.
-Empty topologyKey is not allowed. - |
- true | -
| labelSelector | -object | -
- A label query over a set of resources, in this case pods.
-If it's null, this PodAffinityTerm matches with no Pods. - |
- false | -
| matchLabelKeys | -[]string | -
- MatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-Also, matchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| mismatchLabelKeys | -[]string | -
- MismatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| namespaceSelector | -object | -
- A label query over the set of namespaces that the term applies to.
-The term is applied to the union of the namespaces selected by this field
-and the ones listed in the namespaces field.
-null selector and null or empty namespaces list means "this pod's namespace".
-An empty selector ({}) matches all namespaces. - |
- false | -
| namespaces | -[]string | -
- namespaces specifies a static list of namespace names that the term applies to.
-The term is applied to the union of the namespaces listed in this field
-and the ones selected by namespaceSelector.
-null or empty namespaces list and null namespaceSelector means "this pod's namespace". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| topologyKey | -string | -
- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
-the labelSelector in the specified namespaces, where co-located is defined as running on a node
-whose value of the label with key topologyKey matches that of any node on which any of the
-selected pods is running.
-Empty topologyKey is not allowed. - |
- true | -
| labelSelector | -object | -
- A label query over a set of resources, in this case pods.
-If it's null, this PodAffinityTerm matches with no Pods. - |
- false | -
| matchLabelKeys | -[]string | -
- MatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both matchLabelKeys and labelSelector.
-Also, matchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| mismatchLabelKeys | -[]string | -
- MismatchLabelKeys is a set of pod label keys to select which pods will
-be taken into consideration. The keys are used to lookup values from the
-incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
-to select the group of existing pods which pods will be taken into consideration
-for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
-pod labels will be ignored. The default value is empty.
-The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
-Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. - |
- false | -
| namespaceSelector | -object | -
- A label query over the set of namespaces that the term applies to.
-The term is applied to the union of the namespaces selected by this field
-and the ones listed in the namespaces field.
-null selector and null or empty namespaces list means "this pod's namespace".
-An empty selector ({}) matches all namespaces. - |
- false | -
| namespaces | -[]string | -
- namespaces specifies a static list of namespace names that the term applies to.
-The term is applied to the union of the namespaces listed in this field
-and the ones selected by namespaceSelector.
-null or empty namespaces list and null namespaceSelector means "this pod's namespace". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| matchExpressions | -[]object | -
- matchExpressions is a list of label selector requirements. The requirements are ANDed. - |
- false | -
| matchLabels | -map[string]string | -
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-map is equivalent to an element of matchExpressions, whose key field is "key", the
-operator is "In", and the values array contains only "value". The requirements are ANDed. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| key | -string | -
- key is the label key that the selector applies to. - |
- true | -
| operator | -string | -
- operator represents a key's relationship to a set of values.
-Valid operators are In, NotIn, Exists and DoesNotExist. - |
- true | -
| values | -[]string | -
- values is an array of string values. If the operator is In or NotIn,
-the values array must be non-empty. If the operator is Exists or DoesNotExist,
-the values array must be empty. This array is replaced during a strategic
-merge patch. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name of the referent.
-This field is effectively required, but due to backwards compatibility is
-allowed to be empty. Instances of this type with an empty value here are
-almost certainly wrong.
-More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - - Default: - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| appArmorProfile | -object | -
- appArmorProfile is the AppArmor options to use by the containers in this pod.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| fsGroup | -integer | -
- A special supplemental group that applies to all containers in a pod.
-Some volume types allow the Kubelet to change the ownership of that volume
-to be owned by the pod:
-
-1. The owning GID will be the FSGroup
-2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
-3. The permission bits are OR'd with rw-rw----
-
-If unset, the Kubelet will not modify the ownership and permissions of any volume.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| fsGroupChangePolicy | -string | -
- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
-before being exposed inside Pod. This field will only apply to
-volume types which support fsGroup based ownership(and permissions).
-It will have no effect on ephemeral volume types such as: secret, configmaps
-and emptydir.
-Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| runAsGroup | -integer | -
- The GID to run the entrypoint of the container process.
-Uses runtime default if unset.
-May also be set in SecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence
-for that container.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| runAsNonRoot | -boolean | -
- Indicates that the container must run as a non-root user.
-If true, the Kubelet will validate the image at runtime to ensure that it
-does not run as UID 0 (root) and fail to start the container if it does.
-If unset or false, no such validation will be performed.
-May also be set in SecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| runAsUser | -integer | -
- The UID to run the entrypoint of the container process.
-Defaults to user specified in image metadata if unspecified.
-May also be set in SecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence
-for that container.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| seLinuxOptions | -object | -
- The SELinux context to be applied to all containers.
-If unspecified, the container runtime will allocate a random SELinux context for each
-container. May also be set in SecurityContext. If set in
-both SecurityContext and PodSecurityContext, the value specified in SecurityContext
-takes precedence for that container.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| seccompProfile | -object | -
- The seccomp options to use by the containers in this pod.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| supplementalGroups | -[]integer | -
- A list of groups applied to the first process run in each container, in addition
-to the container's primary GID, the fsGroup (if specified), and group memberships
-defined in the container image for the uid of the container process. If unspecified,
-no additional groups are added to any container. Note that group memberships
-defined in the container image for the uid of the container process are still effective,
-even if they are not included in this list.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| sysctls | -[]object | -
- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
-sysctls (by the container runtime) might fail to launch.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| windowsOptions | -object | -
- The Windows specific settings applied to all containers.
-If unspecified, the options within a container's SecurityContext will be used.
-If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is linux. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of AppArmor profile will be applied.
-Valid options are:
- Localhost - a profile pre-loaded on the node.
- RuntimeDefault - the container runtime's default profile.
- Unconfined - no AppArmor enforcement. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile loaded on the node that should be used.
-The profile must be preconfigured on the node to work.
-Must match the loaded name of the profile.
-Must be set if and only if type is "Localhost". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| level | -string | -
- Level is SELinux level label that applies to the container. - |
- false | -
| role | -string | -
- Role is a SELinux role label that applies to the container. - |
- false | -
| type | -string | -
- Type is a SELinux type label that applies to the container. - |
- false | -
| user | -string | -
- User is a SELinux user label that applies to the container. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of seccomp profile will be applied.
-Valid options are:
-
-Localhost - a profile defined in a file on the node should be used.
-RuntimeDefault - the container runtime default profile should be used.
-Unconfined - no profile should be applied. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile defined in a file on the node should be used.
-The profile must be preconfigured on the node to work.
-Must be a descending path, relative to the kubelet's configured seccomp profile location.
-Must be set if type is "Localhost". Must NOT be set for any other type. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name of a property to set - |
- true | -
| value | -string | -
- Value of a property to set - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| gmsaCredentialSpec | -string | -
- GMSACredentialSpec is where the GMSA admission webhook
-(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
-GMSA credential spec named by the GMSACredentialSpecName field. - |
- false | -
| gmsaCredentialSpecName | -string | -
- GMSACredentialSpecName is the name of the GMSA credential spec to use. - |
- false | -
| hostProcess | -boolean | -
- HostProcess determines if a container should be run as a 'Host Process' container.
-All of a Pod's containers must have the same effective HostProcess value
-(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
-In addition, if HostProcess is true then HostNetwork must also be set to true. - |
- false | -
| runAsUserName | -string | -
- The UserName in Windows to run the entrypoint of the container process.
-Defaults to the user specified in image metadata if unspecified.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| env | -[]object | -
- List of environment variables to set in the container.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
-Note that environment variables provided here will take precedence
-over Tailscale-specific environment variables set by the operator,
-however running proxies with custom values for Tailscale environment
-variables (i.e TS_USERSPACE) is not recommended and might break in
-the future. - |
- false | -
| image | -string | -
- Container image name. By default images are pulled from
-docker.io/tailscale/tailscale, but the official images are also
-available at ghcr.io/tailscale/tailscale. Specifying image name here
-will override any proxy image values specified via the Kubernetes
-operator's Helm chart values or PROXY_IMAGE env var in the operator
-Deployment.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image - |
- false | -
| imagePullPolicy | -enum | -
- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image - - Enum: Always, Never, IfNotPresent - |
- false | -
| resources | -object | -
- Container resource requirements.
-By default Tailscale Kubernetes operator does not apply any resource
-requirements. The amount of resources required wil depend on the
-amount of resources the operator needs to parse, usage patterns and
-cluster size.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources - |
- false | -
| securityContext | -object | -
- Container security context.
-Security context specified here will override the security context by the operator.
-By default the operator:
-- sets 'privileged: true' for the init container
-- set NET_ADMIN capability for tailscale container for proxies that
-are created for Services or Connector.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name of the environment variable. Must be a C_IDENTIFIER. - |
- true | -
| value | -string | -
- Variable references $(VAR_NAME) are expanded using the previously defined
- environment variables in the container and any service environment
-variables. If a variable cannot be resolved, the reference in the input
-string will be unchanged. Double $$ are reduced to a single $, which
-allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
-produce the string literal "$(VAR_NAME)". Escaped references will never
-be expanded, regardless of whether the variable exists or not. Defaults
-to "". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| claims | -[]object | -
- Claims lists the names of resources, defined in spec.resourceClaims,
-that are used by this container.
-
-This is an alpha field and requires enabling the
-DynamicResourceAllocation feature gate.
-
-This field is immutable. It can only be set for containers. - |
- false | -
| limits | -map[string]int or string | -
- Limits describes the maximum amount of compute resources allowed.
-More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - |
- false | -
| requests | -map[string]int or string | -
- Requests describes the minimum amount of compute resources required.
-If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-otherwise to an implementation-defined value. Requests cannot exceed Limits.
-More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name must match the name of one entry in pod.spec.resourceClaims of
-the Pod where this field is used. It makes that resource available
-inside a container. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allowPrivilegeEscalation | -boolean | -
- AllowPrivilegeEscalation controls whether a process can gain more
-privileges than its parent process. This bool directly controls if
-the no_new_privs flag will be set on the container process.
-AllowPrivilegeEscalation is true always when the container is:
-1) run as Privileged
-2) has CAP_SYS_ADMIN
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| appArmorProfile | -object | -
- appArmorProfile is the AppArmor options to use by this container. If set, this profile
-overrides the pod's appArmorProfile.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| capabilities | -object | -
- The capabilities to add/drop when running containers.
-Defaults to the default set of capabilities granted by the container runtime.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| privileged | -boolean | -
- Run container in privileged mode.
-Processes in privileged containers are essentially equivalent to root on the host.
-Defaults to false.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| procMount | -string | -
- procMount denotes the type of proc mount to use for the containers.
-The default is DefaultProcMount which uses the container runtime defaults for
-readonly paths and masked paths.
-This requires the ProcMountType feature flag to be enabled.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| readOnlyRootFilesystem | -boolean | -
- Whether this container has a read-only root filesystem.
-Default is false.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| runAsGroup | -integer | -
- The GID to run the entrypoint of the container process.
-Uses runtime default if unset.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| runAsNonRoot | -boolean | -
- Indicates that the container must run as a non-root user.
-If true, the Kubelet will validate the image at runtime to ensure that it
-does not run as UID 0 (root) and fail to start the container if it does.
-If unset or false, no such validation will be performed.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| runAsUser | -integer | -
- The UID to run the entrypoint of the container process.
-Defaults to user specified in image metadata if unspecified.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| seLinuxOptions | -object | -
- The SELinux context to be applied to the container.
-If unspecified, the container runtime will allocate a random SELinux context for each
-container. May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| seccompProfile | -object | -
- The seccomp options to use by this container. If seccomp options are
-provided at both the pod & container level, the container options
-override the pod options.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| windowsOptions | -object | -
- The Windows specific settings applied to all containers.
-If unspecified, the options from the PodSecurityContext will be used.
-If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is linux. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of AppArmor profile will be applied.
-Valid options are:
- Localhost - a profile pre-loaded on the node.
- RuntimeDefault - the container runtime's default profile.
- Unconfined - no AppArmor enforcement. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile loaded on the node that should be used.
-The profile must be preconfigured on the node to work.
-Must match the loaded name of the profile.
-Must be set if and only if type is "Localhost". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| add | -[]string | -
- Added capabilities - |
- false | -
| drop | -[]string | -
- Removed capabilities - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| level | -string | -
- Level is SELinux level label that applies to the container. - |
- false | -
| role | -string | -
- Role is a SELinux role label that applies to the container. - |
- false | -
| type | -string | -
- Type is a SELinux type label that applies to the container. - |
- false | -
| user | -string | -
- User is a SELinux user label that applies to the container. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of seccomp profile will be applied.
-Valid options are:
-
-Localhost - a profile defined in a file on the node should be used.
-RuntimeDefault - the container runtime default profile should be used.
-Unconfined - no profile should be applied. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile defined in a file on the node should be used.
-The profile must be preconfigured on the node to work.
-Must be a descending path, relative to the kubelet's configured seccomp profile location.
-Must be set if type is "Localhost". Must NOT be set for any other type. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| gmsaCredentialSpec | -string | -
- GMSACredentialSpec is where the GMSA admission webhook
-(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
-GMSA credential spec named by the GMSACredentialSpecName field. - |
- false | -
| gmsaCredentialSpecName | -string | -
- GMSACredentialSpecName is the name of the GMSA credential spec to use. - |
- false | -
| hostProcess | -boolean | -
- HostProcess determines if a container should be run as a 'Host Process' container.
-All of a Pod's containers must have the same effective HostProcess value
-(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
-In addition, if HostProcess is true then HostNetwork must also be set to true. - |
- false | -
| runAsUserName | -string | -
- The UserName in Windows to run the entrypoint of the container process.
-Defaults to the user specified in image metadata if unspecified.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| env | -[]object | -
- List of environment variables to set in the container.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
-Note that environment variables provided here will take precedence
-over Tailscale-specific environment variables set by the operator,
-however running proxies with custom values for Tailscale environment
-variables (i.e TS_USERSPACE) is not recommended and might break in
-the future. - |
- false | -
| image | -string | -
- Container image name. By default images are pulled from
-docker.io/tailscale/tailscale, but the official images are also
-available at ghcr.io/tailscale/tailscale. Specifying image name here
-will override any proxy image values specified via the Kubernetes
-operator's Helm chart values or PROXY_IMAGE env var in the operator
-Deployment.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image - |
- false | -
| imagePullPolicy | -enum | -
- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image - - Enum: Always, Never, IfNotPresent - |
- false | -
| resources | -object | -
- Container resource requirements.
-By default Tailscale Kubernetes operator does not apply any resource
-requirements. The amount of resources required wil depend on the
-amount of resources the operator needs to parse, usage patterns and
-cluster size.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources - |
- false | -
| securityContext | -object | -
- Container security context.
-Security context specified here will override the security context by the operator.
-By default the operator:
-- sets 'privileged: true' for the init container
-- set NET_ADMIN capability for tailscale container for proxies that
-are created for Services or Connector.
-https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name of the environment variable. Must be a C_IDENTIFIER. - |
- true | -
| value | -string | -
- Variable references $(VAR_NAME) are expanded using the previously defined
- environment variables in the container and any service environment
-variables. If a variable cannot be resolved, the reference in the input
-string will be unchanged. Double $$ are reduced to a single $, which
-allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
-produce the string literal "$(VAR_NAME)". Escaped references will never
-be expanded, regardless of whether the variable exists or not. Defaults
-to "". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| claims | -[]object | -
- Claims lists the names of resources, defined in spec.resourceClaims,
-that are used by this container.
-
-This is an alpha field and requires enabling the
-DynamicResourceAllocation feature gate.
-
-This field is immutable. It can only be set for containers. - |
- false | -
| limits | -map[string]int or string | -
- Limits describes the maximum amount of compute resources allowed.
-More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - |
- false | -
| requests | -map[string]int or string | -
- Requests describes the minimum amount of compute resources required.
-If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-otherwise to an implementation-defined value. Requests cannot exceed Limits.
-More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name must match the name of one entry in pod.spec.resourceClaims of
-the Pod where this field is used. It makes that resource available
-inside a container. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| allowPrivilegeEscalation | -boolean | -
- AllowPrivilegeEscalation controls whether a process can gain more
-privileges than its parent process. This bool directly controls if
-the no_new_privs flag will be set on the container process.
-AllowPrivilegeEscalation is true always when the container is:
-1) run as Privileged
-2) has CAP_SYS_ADMIN
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| appArmorProfile | -object | -
- appArmorProfile is the AppArmor options to use by this container. If set, this profile
-overrides the pod's appArmorProfile.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| capabilities | -object | -
- The capabilities to add/drop when running containers.
-Defaults to the default set of capabilities granted by the container runtime.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| privileged | -boolean | -
- Run container in privileged mode.
-Processes in privileged containers are essentially equivalent to root on the host.
-Defaults to false.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| procMount | -string | -
- procMount denotes the type of proc mount to use for the containers.
-The default is DefaultProcMount which uses the container runtime defaults for
-readonly paths and masked paths.
-This requires the ProcMountType feature flag to be enabled.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| readOnlyRootFilesystem | -boolean | -
- Whether this container has a read-only root filesystem.
-Default is false.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| runAsGroup | -integer | -
- The GID to run the entrypoint of the container process.
-Uses runtime default if unset.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| runAsNonRoot | -boolean | -
- Indicates that the container must run as a non-root user.
-If true, the Kubelet will validate the image at runtime to ensure that it
-does not run as UID 0 (root) and fail to start the container if it does.
-If unset or false, no such validation will be performed.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| runAsUser | -integer | -
- The UID to run the entrypoint of the container process.
-Defaults to user specified in image metadata if unspecified.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - - Format: int64 - |
- false | -
| seLinuxOptions | -object | -
- The SELinux context to be applied to the container.
-If unspecified, the container runtime will allocate a random SELinux context for each
-container. May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| seccompProfile | -object | -
- The seccomp options to use by this container. If seccomp options are
-provided at both the pod & container level, the container options
-override the pod options.
-Note that this field cannot be set when spec.os.name is windows. - |
- false | -
| windowsOptions | -object | -
- The Windows specific settings applied to all containers.
-If unspecified, the options from the PodSecurityContext will be used.
-If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
-Note that this field cannot be set when spec.os.name is linux. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of AppArmor profile will be applied.
-Valid options are:
- Localhost - a profile pre-loaded on the node.
- RuntimeDefault - the container runtime's default profile.
- Unconfined - no AppArmor enforcement. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile loaded on the node that should be used.
-The profile must be preconfigured on the node to work.
-Must match the loaded name of the profile.
-Must be set if and only if type is "Localhost". - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| add | -[]string | -
- Added capabilities - |
- false | -
| drop | -[]string | -
- Removed capabilities - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| level | -string | -
- Level is SELinux level label that applies to the container. - |
- false | -
| role | -string | -
- Role is a SELinux role label that applies to the container. - |
- false | -
| type | -string | -
- Type is a SELinux type label that applies to the container. - |
- false | -
| user | -string | -
- User is a SELinux user label that applies to the container. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| type | -string | -
- type indicates which kind of seccomp profile will be applied.
-Valid options are:
-
-Localhost - a profile defined in a file on the node should be used.
-RuntimeDefault - the container runtime default profile should be used.
-Unconfined - no profile should be applied. - |
- true | -
| localhostProfile | -string | -
- localhostProfile indicates a profile defined in a file on the node should be used.
-The profile must be preconfigured on the node to work.
-Must be a descending path, relative to the kubelet's configured seccomp profile location.
-Must be set if type is "Localhost". Must NOT be set for any other type. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| gmsaCredentialSpec | -string | -
- GMSACredentialSpec is where the GMSA admission webhook
-(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
-GMSA credential spec named by the GMSACredentialSpecName field. - |
- false | -
| gmsaCredentialSpecName | -string | -
- GMSACredentialSpecName is the name of the GMSA credential spec to use. - |
- false | -
| hostProcess | -boolean | -
- HostProcess determines if a container should be run as a 'Host Process' container.
-All of a Pod's containers must have the same effective HostProcess value
-(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
-In addition, if HostProcess is true then HostNetwork must also be set to true. - |
- false | -
| runAsUserName | -string | -
- The UserName in Windows to run the entrypoint of the container process.
-Defaults to the user specified in image metadata if unspecified.
-May also be set in PodSecurityContext. If set in both SecurityContext and
-PodSecurityContext, the value specified in SecurityContext takes precedence. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| effect | -string | -
- Effect indicates the taint effect to match. Empty means match all taint effects.
-When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - |
- false | -
| key | -string | -
- Key is the taint key that the toleration applies to. Empty means match all taint keys.
-If the key is empty, operator must be Exists; this combination means to match all values and all keys. - |
- false | -
| operator | -string | -
- Operator represents a key's relationship to the value.
-Valid operators are Exists and Equal. Defaults to Equal.
-Exists is equivalent to wildcard for value, so that a pod can
-tolerate all taints of a particular category. - |
- false | -
| tolerationSeconds | -integer | -
- TolerationSeconds represents the period of time the toleration (which must be
-of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
-it is not set, which means tolerate the taint forever (do not evict). Zero and
-negative values will be treated as 0 (evict immediately) by the system. - - Format: int64 - |
- false | -
| value | -string | -
- Value is the taint value the toleration matches to.
-If the operator is Exists, the value should be empty, otherwise just a regular string. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| acceptRoutes | -boolean | -
- AcceptRoutes can be set to true to make the proxy instance accept
-routes advertized by other nodes on the tailnet, such as subnet
-routes.
-This is equivalent of passing --accept-routes flag to a tailscale Linux client.
-https://tailscale.com/kb/1019/subnets#use-your-subnet-routes-from-other-machines
-Defaults to false. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- List of status conditions to indicate the status of the ProxyClass.
-Known condition types are `ProxyClassReady`. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -