From c5623e0471ec416d32dc99a86aa44a1d569ed62c Mon Sep 17 00:00:00 2001 From: Irbe Krumina Date: Mon, 29 Jul 2024 13:50:27 +0300 Subject: [PATCH] go.{mod,sum},tstest/tools,k8s-operator,cmd/k8s-operator: autogenerate CRD API docs (#12884) Re-instates the functionality that generates CRD API docs, but using a different library as the one we were using earlier seemed to have some issues with its Git history. Also regenerates the docs (make kube-generate-all). Updates tailscale/tailscale#12859 Signed-off-by: Irbe Krumina --- cmd/k8s-operator/operator.go | 3 +- go.mod | 44 +- go.sum | 97 +- k8s-operator/api-docs-config.yaml | 6 + k8s-operator/api.md | 4747 +++-------------------------- tstest/tools/tools.go | 1 + 6 files changed, 537 insertions(+), 4361 deletions(-) create mode 100644 k8s-operator/api-docs-config.yaml diff --git a/cmd/k8s-operator/operator.go b/cmd/k8s-operator/operator.go index 7ccb806c1..9f9fe2f3c 100644 --- a/cmd/k8s-operator/operator.go +++ b/cmd/k8s-operator/operator.go @@ -51,7 +51,8 @@ // Generate static manifests for deploying Tailscale operator on Kubernetes from the operator's Helm chart. //go:generate go run tailscale.com/cmd/k8s-operator/generate staticmanifests -// TODO (irbekrm): generate CRD docs from the yamls +// Generate CRD API docs. +//go:generate go run github.com/elastic/crd-ref-docs --renderer=markdown --source-path=../../k8s-operator/apis/ --config=../../k8s-operator/api-docs-config.yaml --output-path=../../k8s-operator/api.md func main() { // Required to use our client API. We're fine with the instability since the diff --git a/go.mod b/go.mod index f7a004d86..5663c770a 100644 --- a/go.mod +++ b/go.mod @@ -25,6 +25,7 @@ require ( github.com/distribution/reference v0.6.0 github.com/djherbis/times v1.6.0 github.com/dsnet/try v0.0.3 + github.com/elastic/crd-ref-docs v0.0.12 github.com/evanw/esbuild v0.19.11 github.com/frankban/quicktest v1.14.6 github.com/fxamacker/cbor/v2 v2.6.0 @@ -87,28 +88,28 @@ require ( github.com/u-root/u-root v0.12.0 github.com/vishvananda/netlink v1.2.1-beta.2 github.com/vishvananda/netns v0.0.4 - go.uber.org/zap v1.26.0 + go.uber.org/zap v1.27.0 go4.org/mem v0.0.0-20220726221520-4f986261bf13 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba - golang.org/x/crypto v0.24.0 + golang.org/x/crypto v0.25.0 golang.org/x/exp v0.0.0-20240119083558-1b970713d09a - golang.org/x/mod v0.18.0 - golang.org/x/net v0.26.0 + golang.org/x/mod v0.19.0 + golang.org/x/net v0.27.0 golang.org/x/oauth2 v0.16.0 golang.org/x/sync v0.7.0 - golang.org/x/sys v0.21.0 - golang.org/x/term v0.21.0 + golang.org/x/sys v0.22.0 + golang.org/x/term v0.22.0 golang.org/x/time v0.5.0 - golang.org/x/tools v0.22.0 + golang.org/x/tools v0.23.0 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 golang.zx2c4.com/wireguard/windows v0.5.3 gopkg.in/square/go-jose.v2 v2.6.0 gvisor.dev/gvisor v0.0.0-20240306221502-ee1e1f6070e3 honnef.co/go/tools v0.4.6 - k8s.io/api v0.30.1 - k8s.io/apimachinery v0.30.1 - k8s.io/apiserver v0.30.1 - k8s.io/client-go v0.30.1 + k8s.io/api v0.30.3 + k8s.io/apimachinery v0.30.3 + k8s.io/apiserver v0.30.3 + k8s.io/client-go v0.30.3 nhooyr.io/websocket v1.8.10 sigs.k8s.io/controller-runtime v0.18.4 sigs.k8s.io/controller-tools v0.15.1-0.20240618033008-7824932b0cab @@ -117,6 +118,7 @@ require ( ) require ( + github.com/Masterminds/sprig v2.22.0+incompatible // indirect github.com/Microsoft/go-winio v0.6.1 // indirect github.com/bits-and-blooms/bitset v1.13.0 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect @@ -127,6 +129,7 @@ require ( github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gobuffalo/flect v1.0.2 // indirect + github.com/goccy/go-yaml v1.12.0 // indirect github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd // indirect github.com/gorilla/securecookie v1.1.2 // indirect @@ -134,6 +137,7 @@ require ( go.opentelemetry.io/otel v1.22.0 // indirect go.opentelemetry.io/otel/metric v1.22.0 // indirect go.opentelemetry.io/otel/trace v1.22.0 // indirect + golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect ) require ( @@ -201,7 +205,7 @@ require ( github.com/ettle/strcase v0.1.1 // indirect github.com/evanphx/json-patch v5.6.0+incompatible // indirect github.com/evanphx/json-patch/v5 v5.9.0 // indirect - github.com/fatih/color v1.16.0 // indirect + github.com/fatih/color v1.17.0 // indirect github.com/fatih/structtag v1.2.0 // indirect github.com/firefart/nonamedreturns v1.0.4 // indirect github.com/fsnotify/fsnotify v1.7.0 @@ -210,7 +214,7 @@ require ( github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.5.0 // indirect github.com/go-git/go-git/v5 v5.11.0 // indirect - github.com/go-logr/logr v1.4.1 // indirect + github.com/go-logr/logr v1.4.2 // indirect github.com/go-openapi/jsonpointer v0.20.2 // indirect github.com/go-openapi/jsonreference v0.20.4 // indirect github.com/go-openapi/swag v0.22.7 // indirect @@ -252,7 +256,7 @@ require ( github.com/hashicorp/go-version v1.6.0 // indirect github.com/hashicorp/hcl v1.0.0 // indirect github.com/hexops/gotextdiff v1.0.3 // indirect - github.com/huandu/xstrings v1.4.0 // indirect + github.com/huandu/xstrings v1.5.0 // indirect github.com/imdario/mergo v0.3.16 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect @@ -337,14 +341,14 @@ require ( github.com/sourcegraph/go-diff v0.7.0 // indirect github.com/spf13/afero v1.9.5 // indirect github.com/spf13/cast v1.6.0 // indirect - github.com/spf13/cobra v1.8.0 // indirect + github.com/spf13/cobra v1.8.1 // indirect github.com/spf13/jwalterweatherman v1.1.0 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/spf13/viper v1.16.0 // indirect github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect github.com/stbenjam/no-sprintf-host-port v0.1.1 // indirect - github.com/stretchr/objx v0.5.0 // indirect - github.com/stretchr/testify v1.8.4 + github.com/stretchr/objx v0.5.2 // indirect + github.com/stretchr/testify v1.9.0 github.com/subosito/gotenv v1.4.2 // indirect github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect github.com/tailscale/go-winio v0.0.0-20231025203758-c4f33415bf55 @@ -379,10 +383,10 @@ require ( gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 howett.net/plist v1.0.0 // indirect - k8s.io/apiextensions-apiserver v0.30.1 // indirect - k8s.io/klog/v2 v2.120.1 // indirect + k8s.io/apiextensions-apiserver v0.30.3 // indirect + k8s.io/klog/v2 v2.130.1 // indirect k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect - k8s.io/utils v0.0.0-20240102154912-e7106e64919e + k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 mvdan.cc/gofumpt v0.5.0 // indirect mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed // indirect mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b // indirect diff --git a/go.sum b/go.sum index 825ca9c0f..ecb40fae6 100644 --- a/go.sum +++ b/go.sum @@ -73,6 +73,8 @@ github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF0 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0= github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ= +github.com/Masterminds/sprig v2.22.0+incompatible h1:z4yfnGrZ7netVz+0EDJ0Wi+5VZCSYp4Z0m2dk6cEM60= +github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o= github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA= github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= @@ -224,7 +226,7 @@ github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6 h1:8h5+bWd7R6 github.com/coreos/go-iptables v0.7.1-0.20240112124308-65c67c9f46e6/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q= github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU= github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4= -github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= +github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0= github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= @@ -270,6 +272,8 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/dsnet/try v0.0.3 h1:ptR59SsrcFUYbT/FhAbKTV6iLkeD6O18qfIWRml2fqI= github.com/dsnet/try v0.0.3/go.mod h1:WBM8tRpUmnXXhY1U6/S8dt6UWdHTQ7y8A5YSkRCkq40= +github.com/elastic/crd-ref-docs v0.0.12 h1:F3seyncbzUz3rT3d+caeYWhumb5ojYQ6Bl0Z+zOp16M= +github.com/elastic/crd-ref-docs v0.0.12/go.mod h1:X83mMBdJt05heJUYiS3T0yJ/JkCuliuhSUNav5Gjo/U= github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU= github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM= github.com/emicklei/go-restful/v3 v3.11.2 h1:1onLa9DcsMYO9P+CXaL0dStDqQ2EHHXLiz+BtnqkLAU= @@ -292,8 +296,8 @@ github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0 github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ= github.com/evanw/esbuild v0.19.11 h1:mbPO1VJ/df//jjUd+p/nRLYCpizXxXb2w/zZMShxa2k= github.com/evanw/esbuild v0.19.11/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48= -github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= -github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4= +github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI= github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4= github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= @@ -336,8 +340,8 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ= -github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= +github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= @@ -350,6 +354,12 @@ github.com/go-openapi/jsonreference v0.20.4 h1:bKlDxQxQJgwpUSgOENiMPzCTBVuc7vTdX github.com/go-openapi/jsonreference v0.20.4/go.mod h1:5pZJyJP2MnYCpoeoMAql78cCHauHj0V9Lhc506VOpw4= github.com/go-openapi/swag v0.22.7 h1:JWrc1uc/P9cSomxfnsFSVWoE1FW6bNbrVPmpQYpCcR8= github.com/go-openapi/swag v0.22.7/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0= +github.com/go-playground/locales v0.13.0 h1:HyWk6mgj5qFqCT5fjGBuRArbVDfE4hi8+e8ceBS/t7Q= +github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8= +github.com/go-playground/universal-translator v0.17.0 h1:icxd5fm+REJzpZx7ZfpaD876Lmtgy7VtROAbHHXk8no= +github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA= +github.com/go-playground/validator/v10 v10.4.1 h1:pH2c5ADXtd66mxoE0Zm9SUhxE20r7aM3F26W0hOn+GE= +github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4= github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI= github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= @@ -379,6 +389,8 @@ github.com/gobuffalo/flect v1.0.2 h1:eqjPGSo2WmjgY2XlpGwo2NXgL3RucAKo4k4qQMNA5sA github.com/gobuffalo/flect v1.0.2/go.mod h1:A5msMlrHtLqh9umBSnvabjsMrCcCpAyzglnDvkbYKHs= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= +github.com/goccy/go-yaml v1.12.0 h1:/1WHjnMsI1dlIBQutrvSMGZRQufVO3asrHfTwfACoPM= +github.com/goccy/go-yaml v1.12.0/go.mod h1:wKnAMd44+9JAAnGQpWVEgBzGt3YuTaQ4uXoHvE4m7WU= github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 h1:sQspH8M4niEijh3PFscJRLDnkL547IeP7kpPe3uUhEg= github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466/go.mod h1:ZiQxhyQ+bbbfxUKVvjfO498oPYvtYhZzycal3G/NHmU= github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw= @@ -540,8 +552,8 @@ github.com/hdevalence/ed25519consensus v0.2.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3s github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= -github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU= -github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= +github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= +github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= github.com/hugelgupf/vmtest v0.0.0-20240102225328-693afabdd27f h1:ov45/OzrJG8EKbGjn7jJZQJTN7Z1t73sFYNIRd64YlI= github.com/hugelgupf/vmtest v0.0.0-20240102225328-693afabdd27f/go.mod h1:JoDrYMZpDPYo6uH9/f6Peqms3zNNWT2XiGgioMOIGuI= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= @@ -634,6 +646,8 @@ github.com/ldez/gomoddirectives v0.2.3 h1:y7MBaisZVDYmKvt9/l1mjNCiSA1BVn34U0ObUc github.com/ldez/gomoddirectives v0.2.3/go.mod h1:cpgBogWITnCfRq2qGoDkKMEVSaarhdBr6g8G04uz6d0= github.com/ldez/tagliatelle v0.5.0 h1:epgfuYt9v0CG3fms0pEgIMNPuFf/LpPIfjk4kyqSioo= github.com/ldez/tagliatelle v0.5.0/go.mod h1:rj1HmWiL1MiKQuOONhd09iySTEkUuE/8+5jtPYz9xa4= +github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y= +github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII= github.com/leonklingele/grouper v1.1.1 h1:suWXRU57D4/Enn6pXR0QVqqWWrnJ9Osrz+5rjt8ivzU= github.com/leonklingele/grouper v1.1.1/go.mod h1:uk3I3uDfi9B6PeUjsCKi6ndcf63Uy7snXgR4yDYQVDY= github.com/lufeee/execinquery v1.2.1 h1:hf0Ems4SHcUGBxpGN7Jz78z1ppVkP/837ZlETPCEtOM= @@ -857,8 +871,8 @@ github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/ github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0= github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo= -github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0= -github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho= +github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= +github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk= github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= @@ -872,8 +886,9 @@ github.com/stbenjam/no-sprintf-host-port v0.1.1/go.mod h1:TLhvtIvONRzdmkFiio4O8L github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= -github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.1.4/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= @@ -885,8 +900,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= -github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= -github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/studio-b12/gowebdav v0.9.0 h1:1j1sc9gQnNxbXXM4M/CebPOX4aXYtr7MojAVcN4dHjU= github.com/studio-b12/gowebdav v0.9.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE= github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8= @@ -1011,8 +1026,8 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= -go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo= -go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so= +go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8= +go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= go4.org/mem v0.0.0-20220726221520-4f986261bf13 h1:CbZeCBZ0aZj8EfVgnqQcYZgf0lpZ3H9rmp5nkDTAst8= go4.org/mem v0.0.0-20220726221520-4f986261bf13/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g= go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M= @@ -1031,8 +1046,8 @@ golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= -golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI= -golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM= +golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30= +golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1081,8 +1096,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0= -golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= +golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8= +golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1127,8 +1142,8 @@ golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= -golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ= -golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE= +golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys= +golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1222,8 +1237,8 @@ golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws= -golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI= +golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= @@ -1232,8 +1247,8 @@ golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= -golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA= -golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0= +golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk= +golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1328,12 +1343,14 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA= -golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c= +golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg= +golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 h1:LLhsEBxRTBLuKlQxFBYUOU8xyFgXv6cOTp2HASDlsDk= +golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90= golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg= golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI= golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE= @@ -1485,22 +1502,22 @@ honnef.co/go/tools v0.4.6 h1:oFEHCKeID7to/3autwsWfnuv69j3NsfcXbvJKuIcep8= honnef.co/go/tools v0.4.6/go.mod h1:+rnGS1THNh8zMwnd2oVOTL9QF6vmfyG6ZXBULae2uc0= howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM= howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= -k8s.io/api v0.30.1 h1:kCm/6mADMdbAxmIh0LBjS54nQBE+U4KmbCfIkF5CpJY= -k8s.io/api v0.30.1/go.mod h1:ddbN2C0+0DIiPntan/bye3SW3PdwLa11/0yqwvuRrJM= -k8s.io/apiextensions-apiserver v0.30.1 h1:4fAJZ9985BmpJG6PkoxVRpXv9vmPUOVzl614xarePws= -k8s.io/apiextensions-apiserver v0.30.1/go.mod h1:R4GuSrlhgq43oRY9sF2IToFh7PVlF1JjfWdoG3pixk4= -k8s.io/apimachinery v0.30.1 h1:ZQStsEfo4n65yAdlGTfP/uSHMQSoYzU/oeEbkmF7P2U= -k8s.io/apimachinery v0.30.1/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc= -k8s.io/apiserver v0.30.1 h1:BEWEe8bzS12nMtDKXzCF5Q5ovp6LjjYkSp8qOPk8LZ8= -k8s.io/apiserver v0.30.1/go.mod h1:i87ZnQ+/PGAmSbD/iEKM68bm1D5reX8fO4Ito4B01mo= -k8s.io/client-go v0.30.1 h1:uC/Ir6A3R46wdkgCV3vbLyNOYyCJ8oZnjtJGKfytl/Q= -k8s.io/client-go v0.30.1/go.mod h1:wrAqLNs2trwiCH/wxxmT/x3hKVH9PuV0GGW0oDoHVqc= -k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw= -k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= +k8s.io/api v0.30.3 h1:ImHwK9DCsPA9uoU3rVh4QHAHHK5dTSv1nxJUapx8hoQ= +k8s.io/api v0.30.3/go.mod h1:GPc8jlzoe5JG3pb0KJCSLX5oAFIW3/qNJITlDj8BH04= +k8s.io/apiextensions-apiserver v0.30.3 h1:oChu5li2vsZHx2IvnGP3ah8Nj3KyqG3kRSaKmijhB9U= +k8s.io/apiextensions-apiserver v0.30.3/go.mod h1:uhXxYDkMAvl6CJw4lrDN4CPbONkF3+XL9cacCT44kV4= +k8s.io/apimachinery v0.30.3 h1:q1laaWCmrszyQuSQCfNB8cFgCuDAoPszKY4ucAjDwHc= +k8s.io/apimachinery v0.30.3/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc= +k8s.io/apiserver v0.30.3 h1:QZJndA9k2MjFqpnyYv/PH+9PE0SHhx3hBho4X0vE65g= +k8s.io/apiserver v0.30.3/go.mod h1:6Oa88y1CZqnzetd2JdepO0UXzQX4ZnOekx2/PtEjrOg= +k8s.io/client-go v0.30.3 h1:bHrJu3xQZNXIi8/MoxYtZBBWQQXwy16zqJwloXXfD3k= +k8s.io/client-go v0.30.3/go.mod h1:8d4pf8vYu665/kUbsxWAQ/JDBNWqfFeZnvFiVdmx89U= +k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= +k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag= k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98= -k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ= -k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A= +k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= mvdan.cc/gofumpt v0.5.0 h1:0EQ+Z56k8tXjj/6TQD25BFNKQXpCvT0rnansIc7Ug5E= mvdan.cc/gofumpt v0.5.0/go.mod h1:HBeVDtMKRZpXyxFciAirzdKklDlGu8aAy1wEbH5Y9js= mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed h1:WX1yoOaKQfddO/mLzdV4wptyWgoH/6hwLs7QHTixo0I= diff --git a/k8s-operator/api-docs-config.yaml b/k8s-operator/api-docs-config.yaml new file mode 100644 index 000000000..214171ca3 --- /dev/null +++ b/k8s-operator/api-docs-config.yaml @@ -0,0 +1,6 @@ +# Copyright (c) Tailscale Inc & AUTHORS +# SPDX-License-Identifier: BSD-3-Clause + +processor: {} +render: + kubernetesVersion: 1.30 diff --git a/k8s-operator/api.md b/k8s-operator/api.md index b47641d08..1b72df0f2 100644 --- a/k8s-operator/api.md +++ b/k8s-operator/api.md @@ -1,27 +1,25 @@ # API Reference -Packages: - +## Packages - [tailscale.com/v1alpha1](#tailscalecomv1alpha1) -# tailscale.com/v1alpha1 -Resource Types: +## tailscale.com/v1alpha1 + +### Resource Types - [Connector](#connector) - +- [ConnectorList](#connectorlist) - [DNSConfig](#dnsconfig) - +- [DNSConfigList](#dnsconfiglist) - [ProxyClass](#proxyclass) +- [ProxyClassList](#proxyclasslist) -## Connector -[↩ Parent](#tailscalecomv1alpha1 ) - - +#### Connector @@ -32,306 +30,103 @@ Connector is a cluster-scoped resource. More info: https://tailscale.com/kb/1236/kubernetes-operator#deploying-exit-nodes-and-subnet-routers-on-kubernetes-using-connector-custom-resource - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NameTypeDescriptionRequired
apiVersionstringtailscale.com/v1alpha1true
kindstringConnectortrue
metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
specobject - ConnectorSpec describes the desired Tailscale component. -More info: -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
-
- Validations:
  • has(self.subnetRouter) || self.exitNode == true: A Connector needs to be either an exit node or a subnet router, or both.
    • -     		true
    statusobject - ConnectorStatus describes the status of the Connector. This is set -and managed by the Tailscale operator.
    -     		false
    -### Connector.spec -[↩ Parent](#connector) +_Appears in:_ +- [ConnectorList](#connectorlist) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `Connector` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `spec` _[ConnectorSpec](#connectorspec)_ | ConnectorSpec describes the desired Tailscale component.
    More info:
    https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status | | | +| `status` _[ConnectorStatus](#connectorstatus)_ | ConnectorStatus describes the status of the Connector. This is set
    and managed by the Tailscale operator. | | | + + +#### ConnectorList -ConnectorSpec describes the desired Tailscale component. -More info: -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    exitNodeboolean - ExitNode defines whether the Connector node should act as a -Tailscale exit node. Defaults to false. -https://tailscale.com/kb/1103/exit-nodes
    -     		false
    hostnamestring - Hostname is the tailnet hostname that should be assigned to the -Connector node. If unset, hostname defaults to -connector. Hostname can contain lower case letters, numbers and -dashes, it must not start or end with a dash and must be between 2 -and 63 characters long.
    -     		false
    proxyClassstring - ProxyClass is the name of the ProxyClass custom resource that -contains configuration options that should be applied to the -resources created for this Connector. If unset, the operator will -create resources with the default configuration.
    -     		false
    subnetRouterobject - SubnetRouter defines subnet routes that the Connector node should -expose to tailnet. If unset, none are exposed. -https://tailscale.com/kb/1019/subnets/
    -     		false
    tags[]string - Tags that the Tailscale node will be tagged with. -Defaults to [tag:k8s]. -To autoapprove the subnet routes or exit node defined by a Connector, -you can configure Tailscale ACLs to give these tags the necessary -permissions. -See https://tailscale.com/kb/1018/acls/#auto-approvers-for-routes-and-exit-nodes. -If you specify custom tags here, you must also make the operator an owner of these tags. -See https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator. -Tags cannot be changed once a Connector node has been created. -Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$.
    -     		false
    - - -### Connector.spec.subnetRouter -[↩ Parent](#connectorspec) -SubnetRouter defines subnet routes that the Connector node should -expose to tailnet. If unset, none are exposed. -https://tailscale.com/kb/1019/subnets/ - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    advertiseRoutes[]string - AdvertiseRoutes refer to CIDRs that the subnet router should make -available. Route values must be strings that represent a valid IPv4 -or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes. -https://tailscale.com/kb/1201/4via6-subnets/
    -     		true
    - - -### Connector.status -[↩ Parent](#connector) -ConnectorStatus describes the status of the Connector. This is set -and managed by the Tailscale operator. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    conditions[]object - List of status conditions to indicate the status of the Connector. -Known condition types are `ConnectorReady`.
    -     		false
    hostnamestring - Hostname is the fully qualified domain name of the Connector node. -If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the -node.
    -     		false
    isExitNodeboolean - IsExitNode is set to true if the Connector acts as an exit node.
    -     		false
    subnetRoutesstring - SubnetRoutes are the routes currently exposed to tailnet via this -Connector instance.
    -     		false
    tailnetIPs[]string - TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6) -assigned to the Connector node.
    -     		false
    +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `ConnectorList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[Connector](#connector) array_ | | | | -### Connector.status.conditions[index] -[↩ Parent](#connectorstatus) +#### ConnectorSpec -Condition contains details for one aspect of the current state of this API Resource. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    lastTransitionTimestring - lastTransitionTime is the last time the condition transitioned from one status to another. -This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    -
    - Format: date-time
    -     		true
    messagestring - message is a human readable message indicating details about the transition. -This may be an empty string.
    -     		true
    reasonstring - reason contains a programmatic identifier indicating the reason for the condition's last transition. -Producers of specific condition types may define expected values and meanings for this field, -and whether the values are considered a guaranteed API. -The value should be a CamelCase string. -This field may not be empty.
    -     		true
    statusenum - status of the condition, one of True, False, Unknown.
    -
    - Enum: True, False, Unknown
    -     		true
    typestring - type of condition in CamelCase or in foo.example.com/CamelCase.
    -     		true
    observedGenerationinteger - observedGeneration represents the .metadata.generation that the condition was set based upon. -For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date -with respect to the current state of the instance.
    -
    - Format: int64
    - Minimum: 0
    -     		false
    - -## DNSConfig -[↩ Parent](#tailscalecomv1alpha1 ) +ConnectorSpec describes a Tailscale node to be deployed in the cluster. +_Appears in:_ +- [Connector](#connector) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `tags` _[Tags](#tags)_ | Tags that the Tailscale node will be tagged with.
    Defaults to [tag:k8s].
    To autoapprove the subnet routes or exit node defined by a Connector,
    you can configure Tailscale ACLs to give these tags the necessary
    permissions.
    See https://tailscale.com/kb/1018/acls/#auto-approvers-for-routes-and-exit-nodes.
    If you specify custom tags here, you must also make the operator an owner of these tags.
    See https://tailscale.com/kb/1236/kubernetes-operator/#setting-up-the-kubernetes-operator.
    Tags cannot be changed once a Connector node has been created.
    Tag values must be in form ^tag:[a-zA-Z][a-zA-Z0-9-]*$. | | Pattern: `^tag:[a-zA-Z][a-zA-Z0-9-]*$`
    Type: string
    | +| `hostname` _[Hostname](#hostname)_ | Hostname is the tailnet hostname that should be assigned to the
    Connector node. If unset, hostname defaults to name>-connector. Hostname can contain lower case letters, numbers and
    dashes, it must not start or end with a dash and must be between 2
    and 63 characters long. | | Pattern: `^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$`
    Type: string
    | +| `proxyClass` _string_ | ProxyClass is the name of the ProxyClass custom resource that
    contains configuration options that should be applied to the
    resources created for this Connector. If unset, the operator will
    create resources with the default configuration. | | | +| `subnetRouter` _[SubnetRouter](#subnetrouter)_ | SubnetRouter defines subnet routes that the Connector node should
    expose to tailnet. If unset, none are exposed.
    https://tailscale.com/kb/1019/subnets/ | | | +| `exitNode` _boolean_ | ExitNode defines whether the Connector node should act as a
    Tailscale exit node. Defaults to false.
    https://tailscale.com/kb/1103/exit-nodes | | | + + +#### ConnectorStatus + + + +ConnectorStatus defines the observed state of the Connector. + + + +_Appears in:_ +- [Connector](#connector) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta) array_ | List of status conditions to indicate the status of the Connector.
    Known condition types are `ConnectorReady`. | | | +| `subnetRoutes` _string_ | SubnetRoutes are the routes currently exposed to tailnet via this
    Connector instance. | | | +| `isExitNode` _boolean_ | IsExitNode is set to true if the Connector acts as an exit node. | | | +| `tailnetIPs` _string array_ | TailnetIPs is the set of tailnet IP addresses (both IPv4 and IPv6)
    assigned to the Connector node. | | | +| `hostname` _string_ | Hostname is the fully qualified domain name of the Connector node.
    If MagicDNS is enabled in your tailnet, it is the MagicDNS name of the
    node. | | | + + +#### Container + + + + + + + +_Appears in:_ +- [Pod](#pod) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `env` _[Env](#env) array_ | List of environment variables to set in the container.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables
    Note that environment variables provided here will take precedence
    over Tailscale-specific environment variables set by the operator,
    however running proxies with custom values for Tailscale environment
    variables (i.e TS_USERSPACE) is not recommended and might break in
    the future. | | | +| `image` _string_ | Container image name. By default images are pulled from
    docker.io/tailscale/tailscale, but the official images are also
    available at ghcr.io/tailscale/tailscale. Specifying image name here
    will override any proxy image values specified via the Kubernetes
    operator's Helm chart values or PROXY_IMAGE env var in the operator
    Deployment.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | | +| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#pullpolicy-v1-core)_ | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image | | Enum: [Always Never IfNotPresent]
    | +| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#resourcerequirements-v1-core)_ | Container resource requirements.
    By default Tailscale Kubernetes operator does not apply any resource
    requirements. The amount of resources required wil depend on the
    amount of resources the operator needs to parse, usage patterns and
    cluster size.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources | | | +| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#securitycontext-v1-core)_ | Container security context.
    Security context specified here will override the security context by the operator.
    By default the operator:
    - sets 'privileged: true' for the init container
    - set NET_ADMIN capability for tailscale container for proxies that
    are created for Services or Connector.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context | | | + + +#### DNSConfig @@ -362,298 +157,214 @@ tailscale.com/experimental-forward-cluster-traffic-via-ingress annotation to ensure that the proxy created for the Ingress listens on its Pod IP address. NB: Clusters where Pods get assigned IPv6 addresses only are currently not supported. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    apiVersionstringtailscale.com/v1alpha1true
    kindstringDNSConfigtrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject - Spec describes the desired DNS configuration. -More info: -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    -     		true
    statusobject - Status describes the status of the DNSConfig. This is set -and managed by the Tailscale operator.
    -     		false
    -### DNSConfig.spec -[↩ Parent](#dnsconfig) +_Appears in:_ +- [DNSConfigList](#dnsconfiglist) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `DNSConfig` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `spec` _[DNSConfigSpec](#dnsconfigspec)_ | Spec describes the desired DNS configuration.
    More info:
    https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status | | | +| `status` _[DNSConfigStatus](#dnsconfigstatus)_ | Status describes the status of the DNSConfig. This is set
    and managed by the Tailscale operator. | | | + + +#### DNSConfigList -Spec describes the desired DNS configuration. -More info: -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    nameserverobject - Configuration for a nameserver that can resolve ts.net DNS names -associated with in-cluster proxies for Tailscale egress Services and -Tailscale Ingresses. The operator will always deploy this nameserver -when a DNSConfig is applied.
    -     		true
    - - -### DNSConfig.spec.nameserver -[↩ Parent](#dnsconfigspec) -Configuration for a nameserver that can resolve ts.net DNS names -associated with in-cluster proxies for Tailscale egress Services and -Tailscale Ingresses. The operator will always deploy this nameserver -when a DNSConfig is applied. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    imageobject - Nameserver image.
    -     		false
    - - -### DNSConfig.spec.nameserver.image -[↩ Parent](#dnsconfigspecnameserver) -Nameserver image. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    repostring - Repo defaults to tailscale/k8s-nameserver.
    -     		false
    tagstring - Tag defaults to operator's own tag.
    -     		false
    +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `DNSConfigList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[DNSConfig](#dnsconfig) array_ | | | | -### DNSConfig.status -[↩ Parent](#dnsconfig) +#### DNSConfigSpec -Status describes the status of the DNSConfig. This is set -and managed by the Tailscale operator. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    conditions[]object -
    -     		false
    nameserverobject - Nameserver describes the status of nameserver cluster resources.
    -     		false
    - - -### DNSConfig.status.conditions[index] -[↩ Parent](#dnsconfigstatus) -Condition contains details for one aspect of the current state of this API Resource. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    lastTransitionTimestring - lastTransitionTime is the last time the condition transitioned from one status to another. -This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    -
    - Format: date-time
    -     		true
    messagestring - message is a human readable message indicating details about the transition. -This may be an empty string.
    -     		true
    reasonstring - reason contains a programmatic identifier indicating the reason for the condition's last transition. -Producers of specific condition types may define expected values and meanings for this field, -and whether the values are considered a guaranteed API. -The value should be a CamelCase string. -This field may not be empty.
    -     		true
    statusenum - status of the condition, one of True, False, Unknown.
    -
    - Enum: True, False, Unknown
    -     		true
    typestring - type of condition in CamelCase or in foo.example.com/CamelCase.
    -     		true
    observedGenerationinteger - observedGeneration represents the .metadata.generation that the condition was set based upon. -For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date -with respect to the current state of the instance.
    -
    - Format: int64
    - Minimum: 0
    -     		false
    +_Appears in:_ +- [DNSConfig](#dnsconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `nameserver` _[Nameserver](#nameserver)_ | Configuration for a nameserver that can resolve ts.net DNS names
    associated with in-cluster proxies for Tailscale egress Services and
    Tailscale Ingresses. The operator will always deploy this nameserver
    when a DNSConfig is applied. | | | -### DNSConfig.status.nameserver -[↩ Parent](#dnsconfigstatus) +#### DNSConfigStatus -Nameserver describes the status of nameserver cluster resources. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    ipstring - IP is the ClusterIP of the Service fronting the deployed ts.net nameserver. -Currently you must manually update your cluster DNS config to add -this address as a stub nameserver for ts.net for cluster workloads to be -able to resolve MagicDNS names associated with egress or Ingress -proxies. -The IP address will change if you delete and recreate the DNSConfig.
    -     		false
    - -## ProxyClass -[↩ Parent](#tailscalecomv1alpha1 ) +_Appears in:_ +- [DNSConfig](#dnsconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta) array_ | | | | +| `nameserver` _[NameserverStatus](#nameserverstatus)_ | Nameserver describes the status of nameserver cluster resources. | | | + + +#### Env + + + + + + + +_Appears in:_ +- [Container](#container) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `name` _[Name](#name)_ | Name of the environment variable. Must be a C_IDENTIFIER. | | Pattern: `^[-._a-zA-Z][-._a-zA-Z0-9]*$`
    Type: string
    | +| `value` _string_ | Variable references $(VAR_NAME) are expanded using the previously defined
    environment variables in the container and any service environment
    variables. If a variable cannot be resolved, the reference in the input
    string will be unchanged. Double $$ are reduced to a single $, which
    allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
    produce the string literal "$(VAR_NAME)". Escaped references will never
    be expanded, regardless of whether the variable exists or not. Defaults
    to "". | | | + + +#### Hostname + +_Underlying type:_ _string_ + + + +_Validation:_ +- Pattern: `^[a-z0-9][a-z0-9-]{0,61}[a-z0-9]$` +- Type: string + +_Appears in:_ +- [ConnectorSpec](#connectorspec) + + + +#### Image + + + + + + + +_Appears in:_ +- [Nameserver](#nameserver) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `repo` _string_ | Repo defaults to tailscale/k8s-nameserver. | | | +| `tag` _string_ | Tag defaults to operator's own tag. | | | + + +#### Metrics + + + + + + + +_Appears in:_ +- [ProxyClassSpec](#proxyclassspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `enable` _boolean_ | Setting enable to true will make the proxy serve Tailscale metrics
    at :9001/debug/metrics.
    Defaults to false. | | | + + +#### Name + +_Underlying type:_ _string_ + + + +_Validation:_ +- Pattern: `^[-._a-zA-Z][-._a-zA-Z0-9]*$` +- Type: string + +_Appears in:_ +- [Env](#env) + + + +#### Nameserver + + + + + + + +_Appears in:_ +- [DNSConfigSpec](#dnsconfigspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `image` _[Image](#image)_ | Nameserver image. | | | + + +#### NameserverStatus + + + + + + + +_Appears in:_ +- [DNSConfigStatus](#dnsconfigstatus) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `ip` _string_ | IP is the ClusterIP of the Service fronting the deployed ts.net nameserver.
    Currently you must manually update your cluster DNS config to add
    this address as a stub nameserver for ts.net for cluster workloads to be
    able to resolve MagicDNS names associated with egress or Ingress
    proxies.
    The IP address will change if you delete and recreate the DNSConfig. | | | + + +#### Pod + + + + + + + +_Appears in:_ +- [StatefulSet](#statefulset) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `labels` _object (keys:string, values:string)_ | Labels that will be added to the proxy Pod.
    Any labels specified here will be merged with the default labels
    applied to the Pod by the Tailscale Kubernetes operator.
    Label keys and values must be valid Kubernetes label keys and values.
    https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set | | | +| `annotations` _object (keys:string, values:string)_ | Annotations that will be added to the proxy Pod.
    Any annotations specified here will be merged with the default
    annotations applied to the Pod by the Tailscale Kubernetes operator.
    Annotations must be valid Kubernetes annotations.
    https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set | | | +| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#affinity-v1-core)_ | Proxy Pod's affinity rules.
    By default, the Tailscale Kubernetes operator does not apply any affinity rules.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity | | | +| `tailscaleContainer` _[Container](#container)_ | Configuration for the proxy container running tailscale. | | | +| `tailscaleInitContainer` _[Container](#container)_ | Configuration for the proxy init container that enables forwarding. | | | +| `securityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#podsecuritycontext-v1-core)_ | Proxy Pod's security context.
    By default Tailscale Kubernetes operator does not apply any Pod
    security context.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2 | | | +| `imagePullSecrets` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#localobjectreference-v1-core) array_ | Proxy Pod's image pull Secrets.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec | | | +| `nodeName` _string_ | Proxy Pod's node name.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling | | | +| `nodeSelector` _object (keys:string, values:string)_ | Proxy Pod's node selector.
    By default Tailscale Kubernetes operator does not apply any node
    selector.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling | | | +| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#toleration-v1-core) array_ | Proxy Pod's tolerations.
    By default Tailscale Kubernetes operator does not apply any
    tolerations.
    https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling | | | + + +#### ProxyClass + ProxyClass describes a set of configuration parameters that can be applied to @@ -666,3749 +377,185 @@ ProxyClass is a cluster scoped resource. More info: https://tailscale.com/kb/1236/kubernetes-operator#cluster-resource-customization-using-proxyclass-custom-resource. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    apiVersionstringtailscale.com/v1alpha1true
    kindstringProxyClasstrue
    metadataobjectRefer to the Kubernetes API documentation for the fields of the `metadata` field.true
    specobject - Specification of the desired state of the ProxyClass resource. -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    -     		true
    statusobject - Status of the ProxyClass. This is set and managed automatically. -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    -     		false
    - - -### ProxyClass.spec -[↩ Parent](#proxyclass) - - - -Specification of the desired state of the ProxyClass resource. -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    metricsobject - Configuration for proxy metrics. Metrics are currently not supported -for egress proxies and for Ingress proxies that have been configured -with tailscale.com/experimental-forward-cluster-traffic-via-ingress -annotation. Note that the metrics are currently considered unstable -and will likely change in breaking ways in the future - we only -recommend that you use those for debugging purposes.
    -     		false
    statefulSetobject - Configuration parameters for the proxy's StatefulSet. Tailscale -Kubernetes operator deploys a StatefulSet for each of the user -configured proxies (Tailscale Ingress, Tailscale Service, Connector).
    -     		false
    tailscaleobject - TailscaleConfig contains options to configure the tailscale-specific -parameters of proxies.
    -     		false
    - - -### ProxyClass.spec.metrics -[↩ Parent](#proxyclassspec) - - - -Configuration for proxy metrics. Metrics are currently not supported -for egress proxies and for Ingress proxies that have been configured -with tailscale.com/experimental-forward-cluster-traffic-via-ingress -annotation. Note that the metrics are currently considered unstable -and will likely change in breaking ways in the future - we only -recommend that you use those for debugging purposes. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    enableboolean - Setting enable to true will make the proxy serve Tailscale metrics -at :9001/debug/metrics. -Defaults to false.
    -     		true
    - - -### ProxyClass.spec.statefulSet -[↩ Parent](#proxyclassspec) - - - -Configuration parameters for the proxy's StatefulSet. Tailscale -Kubernetes operator deploys a StatefulSet for each of the user -configured proxies (Tailscale Ingress, Tailscale Service, Connector). - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    annotationsmap[string]string - Annotations that will be added to the StatefulSet created for the proxy. -Any Annotations specified here will be merged with the default annotations -applied to the StatefulSet by the Tailscale Kubernetes operator as -well as any other annotations that might have been applied by other -actors. -Annotations must be valid Kubernetes annotations. -https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
    -     		false
    labelsmap[string]string - Labels that will be added to the StatefulSet created for the proxy. -Any labels specified here will be merged with the default labels -applied to the StatefulSet by the Tailscale Kubernetes operator as -well as any other labels that might have been applied by other -actors. -Label keys and values must be valid Kubernetes label keys and values. -https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
    -     		false
    podobject - Configuration for the proxy Pod.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod -[↩ Parent](#proxyclassspecstatefulset) - - - -Configuration for the proxy Pod. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    affinityobject - Proxy Pod's affinity rules. -By default, the Tailscale Kubernetes operator does not apply any affinity rules. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity
    -     		false
    annotationsmap[string]string - Annotations that will be added to the proxy Pod. -Any annotations specified here will be merged with the default -annotations applied to the Pod by the Tailscale Kubernetes operator. -Annotations must be valid Kubernetes annotations. -https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set
    -     		false
    imagePullSecrets[]object - Proxy Pod's image pull Secrets. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodSpec
    -     		false
    labelsmap[string]string - Labels that will be added to the proxy Pod. -Any labels specified here will be merged with the default labels -applied to the Pod by the Tailscale Kubernetes operator. -Label keys and values must be valid Kubernetes label keys and values. -https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
    -     		false
    nodeNamestring - Proxy Pod's node name. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
    -     		false
    nodeSelectormap[string]string - Proxy Pod's node selector. -By default Tailscale Kubernetes operator does not apply any node -selector. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
    -     		false
    securityContextobject - Proxy Pod's security context. -By default Tailscale Kubernetes operator does not apply any Pod -security context. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2
    -     		false
    tailscaleContainerobject - Configuration for the proxy container running tailscale.
    -     		false
    tailscaleInitContainerobject - Configuration for the proxy init container that enables forwarding.
    -     		false
    tolerations[]object - Proxy Pod's tolerations. -By default Tailscale Kubernetes operator does not apply any -tolerations. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -Proxy Pod's affinity rules. -By default, the Tailscale Kubernetes operator does not apply any affinity rules. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#affinity - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    nodeAffinityobject - Describes node affinity scheduling rules for the pod.
    -     		false
    podAffinityobject - Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
    -     		false
    podAntiAffinityobject - Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity -[↩ Parent](#proxyclassspecstatefulsetpodaffinity) - - - -Describes node affinity scheduling rules for the pod. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    preferredDuringSchedulingIgnoredDuringExecution[]object - The scheduler will prefer to schedule pods to nodes that satisfy -the affinity expressions specified by this field, but it may choose -a node that violates one or more of the expressions. The node that is -most preferred is the one with the greatest sum of weights, i.e. -for each node that meets all of the scheduling requirements (resource -request, requiredDuringScheduling affinity expressions, etc.), -compute a sum by iterating through the elements of this field and adding -"weight" to the sum if the node matches the corresponding matchExpressions; the -node(s) with the highest sum are the most preferred.
    -     		false
    requiredDuringSchedulingIgnoredDuringExecutionobject - If the affinity requirements specified by this field are not met at -scheduling time, the pod will not be scheduled onto the node. -If the affinity requirements specified by this field cease to be met -at some point during pod execution (e.g. due to an update), the system -may or may not try to eventually evict the pod from its node.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinity) - - - -An empty preferred scheduling term matches all objects with implicit weight 0 -(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    preferenceobject - A node selector term, associated with the corresponding weight.
    -     		true
    weightinteger - Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
    -
    - Format: int32
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinitypreferredduringschedulingignoredduringexecutionindex) - - - -A node selector term, associated with the corresponding weight. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - A list of node selector requirements by node's labels.
    -     		false
    matchFields[]object - A list of node selector requirements by node's fields.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinitypreferredduringschedulingignoredduringexecutionindexpreference) - - - -A node selector requirement is a selector that contains values, a key, and an operator -that relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - The label key that the selector applies to.
    -     		true
    operatorstring - Represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    -     		true
    values[]string - An array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. If the operator is Gt or Lt, the values -array must have a single element, which will be interpreted as an integer. -This array is replaced during a strategic merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinitypreferredduringschedulingignoredduringexecutionindexpreference) - - - -A node selector requirement is a selector that contains values, a key, and an operator -that relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - The label key that the selector applies to.
    -     		true
    operatorstring - Represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    -     		true
    values[]string - An array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. If the operator is Gt or Lt, the values -array must have a single element, which will be interpreted as an integer. -This array is replaced during a strategic merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinity) - - - -If the affinity requirements specified by this field are not met at -scheduling time, the pod will not be scheduled onto the node. -If the affinity requirements specified by this field cease to be met -at some point during pod execution (e.g. due to an update), the system -may or may not try to eventually evict the pod from its node. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    nodeSelectorTerms[]object - Required. A list of node selector terms. The terms are ORed.
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinityrequiredduringschedulingignoredduringexecution) - - - -A null or empty node selector term matches no objects. The requirements of -them are ANDed. -The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - A list of node selector requirements by node's labels.
    -     		false
    matchFields[]object - A list of node selector requirements by node's fields.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinityrequiredduringschedulingignoredduringexecutionnodeselectortermsindex) - - - -A node selector requirement is a selector that contains values, a key, and an operator -that relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - The label key that the selector applies to.
    -     		true
    operatorstring - Represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    -     		true
    values[]string - An array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. If the operator is Gt or Lt, the values -array must have a single element, which will be interpreted as an integer. -This array is replaced during a strategic merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitynodeaffinityrequiredduringschedulingignoredduringexecutionnodeselectortermsindex) - - - -A node selector requirement is a selector that contains values, a key, and an operator -that relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - The label key that the selector applies to.
    -     		true
    operatorstring - Represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
    -     		true
    values[]string - An array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. If the operator is Gt or Lt, the values -array must have a single element, which will be interpreted as an integer. -This array is replaced during a strategic merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity -[↩ Parent](#proxyclassspecstatefulsetpodaffinity) - - - -Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    preferredDuringSchedulingIgnoredDuringExecution[]object - The scheduler will prefer to schedule pods to nodes that satisfy -the affinity expressions specified by this field, but it may choose -a node that violates one or more of the expressions. The node that is -most preferred is the one with the greatest sum of weights, i.e. -for each node that meets all of the scheduling requirements (resource -request, requiredDuringScheduling affinity expressions, etc.), -compute a sum by iterating through the elements of this field and adding -"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the -node(s) with the highest sum are the most preferred.
    -     		false
    requiredDuringSchedulingIgnoredDuringExecution[]object - If the affinity requirements specified by this field are not met at -scheduling time, the pod will not be scheduled onto the node. -If the affinity requirements specified by this field cease to be met -at some point during pod execution (e.g. due to a pod label update), the -system may or may not try to eventually evict the pod from its node. -When there are multiple elements, the lists of nodes corresponding to each -podAffinityTerm are intersected, i.e. all terms must be satisfied.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinity) - - - -The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    podAffinityTermobject - Required. A pod affinity term, associated with the corresponding weight.
    -     		true
    weightinteger - weight associated with matching the corresponding podAffinityTerm, -in the range 1-100.
    -
    - Format: int32
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinitypreferredduringschedulingignoredduringexecutionindex) - - - -Required. A pod affinity term, associated with the corresponding weight. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    topologyKeystring - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching -the labelSelector in the specified namespaces, where co-located is defined as running on a node -whose value of the label with key topologyKey matches that of any node on which any of the -selected pods is running. -Empty topologyKey is not allowed.
    -     		true
    labelSelectorobject - A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods.
    -     		false
    matchLabelKeys[]string - MatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both matchLabelKeys and labelSelector. -Also, matchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    mismatchLabelKeys[]string - MismatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. -Also, mismatchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    namespaceSelectorobject - A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces.
    -     		false
    namespaces[]string - namespaces specifies a static list of namespace names that the term applies to. -The term is applied to the union of the namespaces listed in this field -and the ones selected by namespaceSelector. -null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinityterm) - - - -A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinitytermlabelselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinityterm) - - - -A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinitytermnamespaceselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinity) - - - -Defines a set of pods (namely those matching the labelSelector -relative to the given namespace(s)) that this pod should be -co-located (affinity) or not co-located (anti-affinity) with, -where co-located is defined as running on a node whose value of -the label with key matches that of any node on which -a pod of the set of pods is running - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    topologyKeystring - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching -the labelSelector in the specified namespaces, where co-located is defined as running on a node -whose value of the label with key topologyKey matches that of any node on which any of the -selected pods is running. -Empty topologyKey is not allowed.
    -     		true
    labelSelectorobject - A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods.
    -     		false
    matchLabelKeys[]string - MatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both matchLabelKeys and labelSelector. -Also, matchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    mismatchLabelKeys[]string - MismatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. -Also, mismatchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    namespaceSelectorobject - A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces.
    -     		false
    namespaces[]string - namespaces specifies a static list of namespace names that the term applies to. -The term is applied to the union of the namespaces listed in this field -and the ones selected by namespaceSelector. -null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinityrequiredduringschedulingignoredduringexecutionindex) - - - -A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinityrequiredduringschedulingignoredduringexecutionindexlabelselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinityrequiredduringschedulingignoredduringexecutionindex) - - - -A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodaffinityrequiredduringschedulingignoredduringexecutionindexnamespaceselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity -[↩ Parent](#proxyclassspecstatefulsetpodaffinity) - - - -Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    preferredDuringSchedulingIgnoredDuringExecution[]object - The scheduler will prefer to schedule pods to nodes that satisfy -the anti-affinity expressions specified by this field, but it may choose -a node that violates one or more of the expressions. The node that is -most preferred is the one with the greatest sum of weights, i.e. -for each node that meets all of the scheduling requirements (resource -request, requiredDuringScheduling anti-affinity expressions, etc.), -compute a sum by iterating through the elements of this field and adding -"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the -node(s) with the highest sum are the most preferred.
    -     		false
    requiredDuringSchedulingIgnoredDuringExecution[]object - If the anti-affinity requirements specified by this field are not met at -scheduling time, the pod will not be scheduled onto the node. -If the anti-affinity requirements specified by this field cease to be met -at some point during pod execution (e.g. due to a pod label update), the -system may or may not try to eventually evict the pod from its node. -When there are multiple elements, the lists of nodes corresponding to each -podAffinityTerm are intersected, i.e. all terms must be satisfied.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinity) - - - -The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    podAffinityTermobject - Required. A pod affinity term, associated with the corresponding weight.
    -     		true
    weightinteger - weight associated with matching the corresponding podAffinityTerm, -in the range 1-100.
    -
    - Format: int32
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinitypreferredduringschedulingignoredduringexecutionindex) - - - -Required. A pod affinity term, associated with the corresponding weight. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    topologyKeystring - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching -the labelSelector in the specified namespaces, where co-located is defined as running on a node -whose value of the label with key topologyKey matches that of any node on which any of the -selected pods is running. -Empty topologyKey is not allowed.
    -     		true
    labelSelectorobject - A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods.
    -     		false
    matchLabelKeys[]string - MatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both matchLabelKeys and labelSelector. -Also, matchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    mismatchLabelKeys[]string - MismatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. -Also, mismatchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    namespaceSelectorobject - A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces.
    -     		false
    namespaces[]string - namespaces specifies a static list of namespace names that the term applies to. -The term is applied to the union of the namespaces listed in this field -and the ones selected by namespaceSelector. -null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinityterm) - - - -A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinitytermlabelselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinityterm) - - - -A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinitypreferredduringschedulingignoredduringexecutionindexpodaffinitytermnamespaceselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinity) - - - -Defines a set of pods (namely those matching the labelSelector -relative to the given namespace(s)) that this pod should be -co-located (affinity) or not co-located (anti-affinity) with, -where co-located is defined as running on a node whose value of -the label with key matches that of any node on which -a pod of the set of pods is running - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    topologyKeystring - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching -the labelSelector in the specified namespaces, where co-located is defined as running on a node -whose value of the label with key topologyKey matches that of any node on which any of the -selected pods is running. -Empty topologyKey is not allowed.
    -     		true
    labelSelectorobject - A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods.
    -     		false
    matchLabelKeys[]string - MatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both matchLabelKeys and labelSelector. -Also, matchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    mismatchLabelKeys[]string - MismatchLabelKeys is a set of pod label keys to select which pods will -be taken into consideration. The keys are used to lookup values from the -incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` -to select the group of existing pods which pods will be taken into consideration -for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming -pod labels will be ignored. The default value is empty. -The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. -Also, mismatchLabelKeys cannot be set when labelSelector isn't set. -This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate.
    -     		false
    namespaceSelectorobject - A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces.
    -     		false
    namespaces[]string - namespaces specifies a static list of namespace names that the term applies to. -The term is applied to the union of the namespaces listed in this field -and the ones selected by namespaceSelector. -null or empty namespaces list and null namespaceSelector means "this pod's namespace".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinityrequiredduringschedulingignoredduringexecutionindex) - - - -A label query over a set of resources, in this case pods. -If it's null, this PodAffinityTerm matches with no Pods. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinityrequiredduringschedulingignoredduringexecutionindexlabelselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinityrequiredduringschedulingignoredduringexecutionindex) - - - -A label query over the set of namespaces that the term applies to. -The term is applied to the union of the namespaces selected by this field -and the ones listed in the namespaces field. -null selector and null or empty namespaces list means "this pod's namespace". -An empty selector ({}) matches all namespaces. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    matchExpressions[]object - matchExpressions is a list of label selector requirements. The requirements are ANDed.
    -     		false
    matchLabelsmap[string]string - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels -map is equivalent to an element of matchExpressions, whose key field is "key", the -operator is "In", and the values array contains only "value". The requirements are ANDed.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index] -[↩ Parent](#proxyclassspecstatefulsetpodaffinitypodantiaffinityrequiredduringschedulingignoredduringexecutionindexnamespaceselector) - - - -A label selector requirement is a selector that contains values, a key, and an operator that -relates the key and values. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    keystring - key is the label key that the selector applies to.
    -     		true
    operatorstring - operator represents a key's relationship to a set of values. -Valid operators are In, NotIn, Exists and DoesNotExist.
    -     		true
    values[]string - values is an array of string values. If the operator is In or NotIn, -the values array must be non-empty. If the operator is Exists or DoesNotExist, -the values array must be empty. This array is replaced during a strategic -merge patch.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.imagePullSecrets[index] -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -LocalObjectReference contains enough information to let you locate the -referenced object inside the same namespace. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name of the referent. -This field is effectively required, but due to backwards compatibility is -allowed to be empty. Instances of this type with an empty value here are -almost certainly wrong. -More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    -
    - Default:
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.securityContext -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -Proxy Pod's security context. -By default Tailscale Kubernetes operator does not apply any Pod -security context. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-2 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    appArmorProfileobject - appArmorProfile is the AppArmor options to use by the containers in this pod. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    fsGroupinteger - A special supplemental group that applies to all containers in a pod. -Some volume types allow the Kubelet to change the ownership of that volume -to be owned by the pod: - -1. The owning GID will be the FSGroup -2. The setgid bit is set (new files created in the volume will be owned by FSGroup) -3. The permission bits are OR'd with rw-rw---- - -If unset, the Kubelet will not modify the ownership and permissions of any volume. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    fsGroupChangePolicystring - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume -before being exposed inside Pod. This field will only apply to -volume types which support fsGroup based ownership(and permissions). -It will have no effect on ephemeral volume types such as: secret, configmaps -and emptydir. -Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    runAsGroupinteger - The GID to run the entrypoint of the container process. -Uses runtime default if unset. -May also be set in SecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence -for that container. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    runAsNonRootboolean - Indicates that the container must run as a non-root user. -If true, the Kubelet will validate the image at runtime to ensure that it -does not run as UID 0 (root) and fail to start the container if it does. -If unset or false, no such validation will be performed. -May also be set in SecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    runAsUserinteger - The UID to run the entrypoint of the container process. -Defaults to user specified in image metadata if unspecified. -May also be set in SecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence -for that container. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    seLinuxOptionsobject - The SELinux context to be applied to all containers. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in SecurityContext. If set in -both SecurityContext and PodSecurityContext, the value specified in SecurityContext -takes precedence for that container. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    seccompProfileobject - The seccomp options to use by the containers in this pod. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    supplementalGroups[]integer - A list of groups applied to the first process run in each container, in addition -to the container's primary GID, the fsGroup (if specified), and group memberships -defined in the container image for the uid of the container process. If unspecified, -no additional groups are added to any container. Note that group memberships -defined in the container image for the uid of the container process are still effective, -even if they are not included in this list. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    sysctls[]object - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported -sysctls (by the container runtime) might fail to launch. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    windowsOptionsobject - The Windows specific settings applied to all containers. -If unspecified, the options within a container's SecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.securityContext.appArmorProfile -[↩ Parent](#proxyclassspecstatefulsetpodsecuritycontext) - - - -appArmorProfile is the AppArmor options to use by the containers in this pod. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of AppArmor profile will be applied. -Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile loaded on the node that should be used. -The profile must be preconfigured on the node to work. -Must match the loaded name of the profile. -Must be set if and only if type is "Localhost".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.securityContext.seLinuxOptions -[↩ Parent](#proxyclassspecstatefulsetpodsecuritycontext) - - - -The SELinux context to be applied to all containers. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in SecurityContext. If set in -both SecurityContext and PodSecurityContext, the value specified in SecurityContext -takes precedence for that container. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    levelstring - Level is SELinux level label that applies to the container.
    -     		false
    rolestring - Role is a SELinux role label that applies to the container.
    -     		false
    typestring - Type is a SELinux type label that applies to the container.
    -     		false
    userstring - User is a SELinux user label that applies to the container.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.securityContext.seccompProfile -[↩ Parent](#proxyclassspecstatefulsetpodsecuritycontext) - - - -The seccomp options to use by the containers in this pod. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of seccomp profile will be applied. -Valid options are: - -Localhost - a profile defined in a file on the node should be used. -RuntimeDefault - the container runtime default profile should be used. -Unconfined - no profile should be applied.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile defined in a file on the node should be used. -The profile must be preconfigured on the node to work. -Must be a descending path, relative to the kubelet's configured seccomp profile location. -Must be set if type is "Localhost". Must NOT be set for any other type.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.securityContext.sysctls[index] -[↩ Parent](#proxyclassspecstatefulsetpodsecuritycontext) - - - -Sysctl defines a kernel parameter to be set - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name of a property to set
    -     		true
    valuestring - Value of a property to set
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.securityContext.windowsOptions -[↩ Parent](#proxyclassspecstatefulsetpodsecuritycontext) - - - -The Windows specific settings applied to all containers. -If unspecified, the options within a container's SecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    gmsaCredentialSpecstring - GMSACredentialSpec is where the GMSA admission webhook -(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the -GMSA credential spec named by the GMSACredentialSpecName field.
    -     		false
    gmsaCredentialSpecNamestring - GMSACredentialSpecName is the name of the GMSA credential spec to use.
    -     		false
    hostProcessboolean - HostProcess determines if a container should be run as a 'Host Process' container. -All of a Pod's containers must have the same effective HostProcess value -(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). -In addition, if HostProcess is true then HostNetwork must also be set to true.
    -     		false
    runAsUserNamestring - The UserName in Windows to run the entrypoint of the container process. -Defaults to the user specified in image metadata if unspecified. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -Configuration for the proxy container running tailscale. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    env[]object - List of environment variables to set in the container. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables -Note that environment variables provided here will take precedence -over Tailscale-specific environment variables set by the operator, -however running proxies with custom values for Tailscale environment -variables (i.e TS_USERSPACE) is not recommended and might break in -the future.
    -     		false
    imagestring - Container image name. By default images are pulled from -docker.io/tailscale/tailscale, but the official images are also -available at ghcr.io/tailscale/tailscale. Specifying image name here -will override any proxy image values specified via the Kubernetes -operator's Helm chart values or PROXY_IMAGE env var in the operator -Deployment. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
    -     		false
    imagePullPolicyenum - Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
    -
    - Enum: Always, Never, IfNotPresent
    -     		false
    resourcesobject - Container resource requirements. -By default Tailscale Kubernetes operator does not apply any resource -requirements. The amount of resources required wil depend on the -amount of resources the operator needs to parse, usage patterns and -cluster size. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
    -     		false
    securityContextobject - Container security context. -Security context specified here will override the security context by the operator. -By default the operator: -- sets 'privileged: true' for the init container -- set NET_ADMIN capability for tailscale container for proxies that -are created for Services or Connector. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.env[index] -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainer) - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name of the environment variable. Must be a C_IDENTIFIER.
    -     		true
    valuestring - Variable references $(VAR_NAME) are expanded using the previously defined - environment variables in the container and any service environment -variables. If a variable cannot be resolved, the reference in the input -string will be unchanged. Double $$ are reduced to a single $, which -allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will -produce the string literal "$(VAR_NAME)". Escaped references will never -be expanded, regardless of whether the variable exists or not. Defaults -to "".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.resources -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainer) - - - -Container resource requirements. -By default Tailscale Kubernetes operator does not apply any resource -requirements. The amount of resources required wil depend on the -amount of resources the operator needs to parse, usage patterns and -cluster size. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    claims[]object - Claims lists the names of resources, defined in spec.resourceClaims, -that are used by this container. - -This is an alpha field and requires enabling the -DynamicResourceAllocation feature gate. - -This field is immutable. It can only be set for containers.
    -     		false
    limitsmap[string]int or string - Limits describes the maximum amount of compute resources allowed. -More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    -     		false
    requestsmap[string]int or string - Requests describes the minimum amount of compute resources required. -If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, -otherwise to an implementation-defined value. Requests cannot exceed Limits. -More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.resources.claims[index] -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainerresources) - - - -ResourceClaim references one entry in PodSpec.ResourceClaims. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name must match the name of one entry in pod.spec.resourceClaims of -the Pod where this field is used. It makes that resource available -inside a container.
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainer) - - - -Container security context. -Security context specified here will override the security context by the operator. -By default the operator: -- sets 'privileged: true' for the init container -- set NET_ADMIN capability for tailscale container for proxies that -are created for Services or Connector. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    allowPrivilegeEscalationboolean - AllowPrivilegeEscalation controls whether a process can gain more -privileges than its parent process. This bool directly controls if -the no_new_privs flag will be set on the container process. -AllowPrivilegeEscalation is true always when the container is: -1) run as Privileged -2) has CAP_SYS_ADMIN -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    appArmorProfileobject - appArmorProfile is the AppArmor options to use by this container. If set, this profile -overrides the pod's appArmorProfile. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    capabilitiesobject - The capabilities to add/drop when running containers. -Defaults to the default set of capabilities granted by the container runtime. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    privilegedboolean - Run container in privileged mode. -Processes in privileged containers are essentially equivalent to root on the host. -Defaults to false. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    procMountstring - procMount denotes the type of proc mount to use for the containers. -The default is DefaultProcMount which uses the container runtime defaults for -readonly paths and masked paths. -This requires the ProcMountType feature flag to be enabled. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    readOnlyRootFilesystemboolean - Whether this container has a read-only root filesystem. -Default is false. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    runAsGroupinteger - The GID to run the entrypoint of the container process. -Uses runtime default if unset. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    runAsNonRootboolean - Indicates that the container must run as a non-root user. -If true, the Kubelet will validate the image at runtime to ensure that it -does not run as UID 0 (root) and fail to start the container if it does. -If unset or false, no such validation will be performed. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    runAsUserinteger - The UID to run the entrypoint of the container process. -Defaults to user specified in image metadata if unspecified. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    seLinuxOptionsobject - The SELinux context to be applied to the container. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    seccompProfileobject - The seccomp options to use by this container. If seccomp options are -provided at both the pod & container level, the container options -override the pod options. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    windowsOptionsobject - The Windows specific settings applied to all containers. -If unspecified, the options from the PodSecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext.appArmorProfile -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainersecuritycontext) - - - -appArmorProfile is the AppArmor options to use by this container. If set, this profile -overrides the pod's appArmorProfile. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of AppArmor profile will be applied. -Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile loaded on the node that should be used. -The profile must be preconfigured on the node to work. -Must match the loaded name of the profile. -Must be set if and only if type is "Localhost".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext.capabilities -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainersecuritycontext) - - - -The capabilities to add/drop when running containers. -Defaults to the default set of capabilities granted by the container runtime. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    add[]string - Added capabilities
    -     		false
    drop[]string - Removed capabilities
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext.seLinuxOptions -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainersecuritycontext) - - - -The SELinux context to be applied to the container. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    levelstring - Level is SELinux level label that applies to the container.
    -     		false
    rolestring - Role is a SELinux role label that applies to the container.
    -     		false
    typestring - Type is a SELinux type label that applies to the container.
    -     		false
    userstring - User is a SELinux user label that applies to the container.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext.seccompProfile -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainersecuritycontext) - - - -The seccomp options to use by this container. If seccomp options are -provided at both the pod & container level, the container options -override the pod options. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of seccomp profile will be applied. -Valid options are: - -Localhost - a profile defined in a file on the node should be used. -RuntimeDefault - the container runtime default profile should be used. -Unconfined - no profile should be applied.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile defined in a file on the node should be used. -The profile must be preconfigured on the node to work. -Must be a descending path, relative to the kubelet's configured seccomp profile location. -Must be set if type is "Localhost". Must NOT be set for any other type.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleContainer.securityContext.windowsOptions -[↩ Parent](#proxyclassspecstatefulsetpodtailscalecontainersecuritycontext) - - - -The Windows specific settings applied to all containers. -If unspecified, the options from the PodSecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    gmsaCredentialSpecstring - GMSACredentialSpec is where the GMSA admission webhook -(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the -GMSA credential spec named by the GMSACredentialSpecName field.
    -     		false
    gmsaCredentialSpecNamestring - GMSACredentialSpecName is the name of the GMSA credential spec to use.
    -     		false
    hostProcessboolean - HostProcess determines if a container should be run as a 'Host Process' container. -All of a Pod's containers must have the same effective HostProcess value -(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). -In addition, if HostProcess is true then HostNetwork must also be set to true.
    -     		false
    runAsUserNamestring - The UserName in Windows to run the entrypoint of the container process. -Defaults to the user specified in image metadata if unspecified. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -Configuration for the proxy init container that enables forwarding. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    env[]object - List of environment variables to set in the container. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#environment-variables -Note that environment variables provided here will take precedence -over Tailscale-specific environment variables set by the operator, -however running proxies with custom values for Tailscale environment -variables (i.e TS_USERSPACE) is not recommended and might break in -the future.
    -     		false
    imagestring - Container image name. By default images are pulled from -docker.io/tailscale/tailscale, but the official images are also -available at ghcr.io/tailscale/tailscale. Specifying image name here -will override any proxy image values specified via the Kubernetes -operator's Helm chart values or PROXY_IMAGE env var in the operator -Deployment. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
    -     		false
    imagePullPolicyenum - Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#image
    -
    - Enum: Always, Never, IfNotPresent
    -     		false
    resourcesobject - Container resource requirements. -By default Tailscale Kubernetes operator does not apply any resource -requirements. The amount of resources required wil depend on the -amount of resources the operator needs to parse, usage patterns and -cluster size. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources
    -     		false
    securityContextobject - Container security context. -Security context specified here will override the security context by the operator. -By default the operator: -- sets 'privileged: true' for the init container -- set NET_ADMIN capability for tailscale container for proxies that -are created for Services or Connector. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.env[index] -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainer) - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name of the environment variable. Must be a C_IDENTIFIER.
    -     		true
    valuestring - Variable references $(VAR_NAME) are expanded using the previously defined - environment variables in the container and any service environment -variables. If a variable cannot be resolved, the reference in the input -string will be unchanged. Double $$ are reduced to a single $, which -allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will -produce the string literal "$(VAR_NAME)". Escaped references will never -be expanded, regardless of whether the variable exists or not. Defaults -to "".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.resources -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainer) - - - -Container resource requirements. -By default Tailscale Kubernetes operator does not apply any resource -requirements. The amount of resources required wil depend on the -amount of resources the operator needs to parse, usage patterns and -cluster size. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#resources - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    claims[]object - Claims lists the names of resources, defined in spec.resourceClaims, -that are used by this container. - -This is an alpha field and requires enabling the -DynamicResourceAllocation feature gate. - -This field is immutable. It can only be set for containers.
    -     		false
    limitsmap[string]int or string - Limits describes the maximum amount of compute resources allowed. -More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    -     		false
    requestsmap[string]int or string - Requests describes the minimum amount of compute resources required. -If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, -otherwise to an implementation-defined value. Requests cannot exceed Limits. -More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.resources.claims[index] -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainerresources) - - - -ResourceClaim references one entry in PodSpec.ResourceClaims. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    namestring - Name must match the name of one entry in pod.spec.resourceClaims of -the Pod where this field is used. It makes that resource available -inside a container.
    -     		true
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainer) - - - -Container security context. -Security context specified here will override the security context by the operator. -By default the operator: -- sets 'privileged: true' for the init container -- set NET_ADMIN capability for tailscale container for proxies that -are created for Services or Connector. -https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    allowPrivilegeEscalationboolean - AllowPrivilegeEscalation controls whether a process can gain more -privileges than its parent process. This bool directly controls if -the no_new_privs flag will be set on the container process. -AllowPrivilegeEscalation is true always when the container is: -1) run as Privileged -2) has CAP_SYS_ADMIN -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    appArmorProfileobject - appArmorProfile is the AppArmor options to use by this container. If set, this profile -overrides the pod's appArmorProfile. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    capabilitiesobject - The capabilities to add/drop when running containers. -Defaults to the default set of capabilities granted by the container runtime. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    privilegedboolean - Run container in privileged mode. -Processes in privileged containers are essentially equivalent to root on the host. -Defaults to false. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    procMountstring - procMount denotes the type of proc mount to use for the containers. -The default is DefaultProcMount which uses the container runtime defaults for -readonly paths and masked paths. -This requires the ProcMountType feature flag to be enabled. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    readOnlyRootFilesystemboolean - Whether this container has a read-only root filesystem. -Default is false. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    runAsGroupinteger - The GID to run the entrypoint of the container process. -Uses runtime default if unset. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    runAsNonRootboolean - Indicates that the container must run as a non-root user. -If true, the Kubelet will validate the image at runtime to ensure that it -does not run as UID 0 (root) and fail to start the container if it does. -If unset or false, no such validation will be performed. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    runAsUserinteger - The UID to run the entrypoint of the container process. -Defaults to user specified in image metadata if unspecified. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -
    - Format: int64
    -     		false
    seLinuxOptionsobject - The SELinux context to be applied to the container. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    seccompProfileobject - The seccomp options to use by this container. If seccomp options are -provided at both the pod & container level, the container options -override the pod options. -Note that this field cannot be set when spec.os.name is windows.
    -     		false
    windowsOptionsobject - The Windows specific settings applied to all containers. -If unspecified, the options from the PodSecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext.appArmorProfile -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainersecuritycontext) - - - -appArmorProfile is the AppArmor options to use by this container. If set, this profile -overrides the pod's appArmorProfile. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of AppArmor profile will be applied. -Valid options are: - Localhost - a profile pre-loaded on the node. - RuntimeDefault - the container runtime's default profile. - Unconfined - no AppArmor enforcement.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile loaded on the node that should be used. -The profile must be preconfigured on the node to work. -Must match the loaded name of the profile. -Must be set if and only if type is "Localhost".
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext.capabilities -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainersecuritycontext) - - - -The capabilities to add/drop when running containers. -Defaults to the default set of capabilities granted by the container runtime. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    add[]string - Added capabilities
    -     		false
    drop[]string - Removed capabilities
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext.seLinuxOptions -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainersecuritycontext) - - - -The SELinux context to be applied to the container. -If unspecified, the container runtime will allocate a random SELinux context for each -container. May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    levelstring - Level is SELinux level label that applies to the container.
    -     		false
    rolestring - Role is a SELinux role label that applies to the container.
    -     		false
    typestring - Type is a SELinux type label that applies to the container.
    -     		false
    userstring - User is a SELinux user label that applies to the container.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext.seccompProfile -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainersecuritycontext) - - - -The seccomp options to use by this container. If seccomp options are -provided at both the pod & container level, the container options -override the pod options. -Note that this field cannot be set when spec.os.name is windows. - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    typestring - type indicates which kind of seccomp profile will be applied. -Valid options are: - -Localhost - a profile defined in a file on the node should be used. -RuntimeDefault - the container runtime default profile should be used. -Unconfined - no profile should be applied.
    -     		true
    localhostProfilestring - localhostProfile indicates a profile defined in a file on the node should be used. -The profile must be preconfigured on the node to work. -Must be a descending path, relative to the kubelet's configured seccomp profile location. -Must be set if type is "Localhost". Must NOT be set for any other type.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tailscaleInitContainer.securityContext.windowsOptions -[↩ Parent](#proxyclassspecstatefulsetpodtailscaleinitcontainersecuritycontext) - - - -The Windows specific settings applied to all containers. -If unspecified, the options from the PodSecurityContext will be used. -If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. -Note that this field cannot be set when spec.os.name is linux. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    gmsaCredentialSpecstring - GMSACredentialSpec is where the GMSA admission webhook -(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the -GMSA credential spec named by the GMSACredentialSpecName field.
    -     		false
    gmsaCredentialSpecNamestring - GMSACredentialSpecName is the name of the GMSA credential spec to use.
    -     		false
    hostProcessboolean - HostProcess determines if a container should be run as a 'Host Process' container. -All of a Pod's containers must have the same effective HostProcess value -(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). -In addition, if HostProcess is true then HostNetwork must also be set to true.
    -     		false
    runAsUserNamestring - The UserName in Windows to run the entrypoint of the container process. -Defaults to the user specified in image metadata if unspecified. -May also be set in PodSecurityContext. If set in both SecurityContext and -PodSecurityContext, the value specified in SecurityContext takes precedence.
    -     		false
    - - -### ProxyClass.spec.statefulSet.pod.tolerations[index] -[↩ Parent](#proxyclassspecstatefulsetpod) - - - -The pod this Toleration is attached to tolerates any taint that matches -the triple using the matching operator . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    effectstring - Effect indicates the taint effect to match. Empty means match all taint effects. -When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
    -     		false
    keystring - Key is the taint key that the toleration applies to. Empty means match all taint keys. -If the key is empty, operator must be Exists; this combination means to match all values and all keys.
    -     		false
    operatorstring - Operator represents a key's relationship to the value. -Valid operators are Exists and Equal. Defaults to Equal. -Exists is equivalent to wildcard for value, so that a pod can -tolerate all taints of a particular category.
    -     		false
    tolerationSecondsinteger - TolerationSeconds represents the period of time the toleration (which must be -of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, -it is not set, which means tolerate the taint forever (do not evict). Zero and -negative values will be treated as 0 (evict immediately) by the system.
    -
    - Format: int64
    -     		false
    valuestring - Value is the taint value the toleration matches to. -If the operator is Exists, the value should be empty, otherwise just a regular string.
    -     		false
    - - -### ProxyClass.spec.tailscale -[↩ Parent](#proxyclassspec) - - - -TailscaleConfig contains options to configure the tailscale-specific -parameters of proxies. - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    acceptRoutesboolean - AcceptRoutes can be set to true to make the proxy instance accept -routes advertized by other nodes on the tailnet, such as subnet -routes. -This is equivalent of passing --accept-routes flag to a tailscale Linux client. -https://tailscale.com/kb/1019/subnets#use-your-subnet-routes-from-other-machines -Defaults to false.
    -     		false
    - - -### ProxyClass.status -[↩ Parent](#proxyclass) - - - -Status of the ProxyClass. This is set and managed automatically. -https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    conditions[]object - List of status conditions to indicate the status of the ProxyClass. -Known condition types are `ProxyClassReady`.
    -     		false
    - - -### ProxyClass.status.conditions[index] -[↩ Parent](#proxyclassstatus) - - - -Condition contains details for one aspect of the current state of this API Resource. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescriptionRequired
    lastTransitionTimestring - lastTransitionTime is the last time the condition transitioned from one status to another. -This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    -
    - Format: date-time
    -     		true
    messagestring - message is a human readable message indicating details about the transition. -This may be an empty string.
    -     		true
    reasonstring - reason contains a programmatic identifier indicating the reason for the condition's last transition. -Producers of specific condition types may define expected values and meanings for this field, -and whether the values are considered a guaranteed API. -The value should be a CamelCase string. -This field may not be empty.
    -     		true
    statusenum - status of the condition, one of True, False, Unknown.
    -
    - Enum: True, False, Unknown
    -     		true
    typestring - type of condition in CamelCase or in foo.example.com/CamelCase.
    -     		true
    observedGenerationinteger - observedGeneration represents the .metadata.generation that the condition was set based upon. -For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date -with respect to the current state of the instance.
    -
    - Format: int64
    - Minimum: 0
    -     		false
    + + +_Appears in:_ +- [ProxyClassList](#proxyclasslist) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `ProxyClass` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `spec` _[ProxyClassSpec](#proxyclassspec)_ | Specification of the desired state of the ProxyClass resource.
    https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status | | | +| `status` _[ProxyClassStatus](#proxyclassstatus)_ | Status of the ProxyClass. This is set and managed automatically.
    https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status | | | + + +#### ProxyClassList + + + + + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `tailscale.com/v1alpha1` | | | +| `kind` _string_ | `ProxyClassList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
    Servers may infer this from the endpoint the client submits requests to.
    Cannot be updated.
    In CamelCase.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
    Servers should convert recognized schemas to the latest internal value, and
    may reject unrecognized values.
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[ProxyClass](#proxyclass) array_ | | | | + + +#### ProxyClassSpec + + + + + + + +_Appears in:_ +- [ProxyClass](#proxyclass) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `statefulSet` _[StatefulSet](#statefulset)_ | Configuration parameters for the proxy's StatefulSet. Tailscale
    Kubernetes operator deploys a StatefulSet for each of the user
    configured proxies (Tailscale Ingress, Tailscale Service, Connector). | | | +| `metrics` _[Metrics](#metrics)_ | Configuration for proxy metrics. Metrics are currently not supported
    for egress proxies and for Ingress proxies that have been configured
    with tailscale.com/experimental-forward-cluster-traffic-via-ingress
    annotation. Note that the metrics are currently considered unstable
    and will likely change in breaking ways in the future - we only
    recommend that you use those for debugging purposes. | | | +| `tailscale` _[TailscaleConfig](#tailscaleconfig)_ | TailscaleConfig contains options to configure the tailscale-specific
    parameters of proxies. | | | + + +#### ProxyClassStatus + + + + + + + +_Appears in:_ +- [ProxyClass](#proxyclass) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.3/#condition-v1-meta) array_ | List of status conditions to indicate the status of the ProxyClass.
    Known condition types are `ProxyClassReady`. | | | + + +#### Route + +_Underlying type:_ _string_ + + + +_Validation:_ +- Format: cidr +- Type: string + +_Appears in:_ +- [Routes](#routes) + + + +#### Routes + +_Underlying type:_ _[Route](#route)_ + + + +_Validation:_ +- Format: cidr +- MinItems: 1 +- Type: string + +_Appears in:_ +- [SubnetRouter](#subnetrouter) + + + +#### StatefulSet + + + + + + + +_Appears in:_ +- [ProxyClassSpec](#proxyclassspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `labels` _object (keys:string, values:string)_ | Labels that will be added to the StatefulSet created for the proxy.
    Any labels specified here will be merged with the default labels
    applied to the StatefulSet by the Tailscale Kubernetes operator as
    well as any other labels that might have been applied by other
    actors.
    Label keys and values must be valid Kubernetes label keys and values.
    https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set | | | +| `annotations` _object (keys:string, values:string)_ | Annotations that will be added to the StatefulSet created for the proxy.
    Any Annotations specified here will be merged with the default annotations
    applied to the StatefulSet by the Tailscale Kubernetes operator as
    well as any other annotations that might have been applied by other
    actors.
    Annotations must be valid Kubernetes annotations.
    https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/#syntax-and-character-set | | | +| `pod` _[Pod](#pod)_ | Configuration for the proxy Pod. | | | + + +#### SubnetRouter + + + +SubnetRouter defines subnet routes that should be exposed to tailnet via a +Connector node. + + + +_Appears in:_ +- [ConnectorSpec](#connectorspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `advertiseRoutes` _[Routes](#routes)_ | AdvertiseRoutes refer to CIDRs that the subnet router should make
    available. Route values must be strings that represent a valid IPv4
    or IPv6 CIDR range. Values can be Tailscale 4via6 subnet routes.
    https://tailscale.com/kb/1201/4via6-subnets/ | | Format: cidr
    MinItems: 1
    Type: string
    | + + +#### Tag + +_Underlying type:_ _string_ + + + +_Validation:_ +- Pattern: `^tag:[a-zA-Z][a-zA-Z0-9-]*$` +- Type: string + +_Appears in:_ +- [Tags](#tags) + + + +#### Tags + +_Underlying type:_ _[Tag](#tag)_ + + + +_Validation:_ +- Pattern: `^tag:[a-zA-Z][a-zA-Z0-9-]*$` +- Type: string + +_Appears in:_ +- [ConnectorSpec](#connectorspec) + + + +#### TailscaleConfig + + + + + + + +_Appears in:_ +- [ProxyClassSpec](#proxyclassspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `acceptRoutes` _boolean_ | AcceptRoutes can be set to true to make the proxy instance accept
    routes advertized by other nodes on the tailnet, such as subnet
    routes.
    This is equivalent of passing --accept-routes flag to a tailscale Linux client.
    https://tailscale.com/kb/1019/subnets#use-your-subnet-routes-from-other-machines
    Defaults to false. | | | + + diff --git a/tstest/tools/tools.go b/tstest/tools/tools.go index 46060da26..4d810483b 100644 --- a/tstest/tools/tools.go +++ b/tstest/tools/tools.go @@ -8,6 +8,7 @@ package tools import ( + _ "github.com/elastic/crd-ref-docs" _ "github.com/tailscale/mkctr" _ "honnef.co/go/tools/cmd/staticcheck" _ "sigs.k8s.io/controller-tools/cmd/controller-gen"