diff --git a/.github/workflows/gemini-manual.yml b/.gitea/inactive/gemini-manual.yml.disabled similarity index 100% rename from .github/workflows/gemini-manual.yml rename to .gitea/inactive/gemini-manual.yml.disabled diff --git a/.gitea/known_hosts b/.gitea/known_hosts new file mode 100644 index 0000000..36f3488 --- /dev/null +++ b/.gitea/known_hosts @@ -0,0 +1 @@ +[git.ermnvldmr.com]:22222,[45.150.33.239]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD diff --git a/.gitea/workflows/ci-next-build-golden-image.yml b/.gitea/workflows/ci-next-build-golden-image.yml new file mode 100644 index 0000000..6baf9d5 --- /dev/null +++ b/.gitea/workflows/ci-next-build-golden-image.yml @@ -0,0 +1,70 @@ +name: ci - next/build-golden-image +'on': + workflow_dispatch: null +concurrency: + group: ci-golden-image + cancel-in-progress: false +permissions: + contents: read +jobs: + validate-scripts: + name: Validate - Provisioner Scripts + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Validate Shell Script Syntax + run: bash -n ci/packer/scripts/*.sh + build-image: + name: Build - Golden Image + needs: validate-scripts + runs-on: apex-debian13 + outputs: + image_name: ${{ steps.vars.outputs.image_name }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Calculate Image Name + id: vars + run: 'SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)" + + IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2" + + echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT" + + ' + - name: Install Build Tools + run: 'sudo apt-get update + + sudo apt-get install -y qemu-utils + + ' + - name: Build Debian K3s Golden Image + run: bash ci/scripts/build-golden-image.sh + - name: Prepare and Upload Image Artifact + uses: actions/upload-artifact@v4 + with: + name: golden-image + path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 + retention-days: 30 + upload-s3: + name: Upload - S3 Storage + needs: build-image + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Download Image Artifact + uses: actions/download-artifact@v4 + with: + name: golden-image + path: output-qemu + - name: Upload to Static S3 (/dev/images/) + run: bash ci/scripts/upload-golden-image.sh "${IMAGE_NAME}" + env: + AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'auto' }} + S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }} + S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }} + IMAGE_NAME: ${{ needs.build-image.outputs.image_name }} diff --git a/.gitea/workflows/packages-kits-next-required.yml b/.gitea/workflows/packages-kits-next-required.yml new file mode 100644 index 0000000..69620ca --- /dev/null +++ b/.gitea/workflows/packages-kits-next-required.yml @@ -0,0 +1,332 @@ +name: packages/kits - next/required +'on': + push: + branches: + - next + paths: + - packages/kits/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/packages-kits-next-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-next-kits-${{ github.ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs & UI + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Build UI + run: pnpm --filter @ermnvldmr/ui build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + retention-days: 30 + - name: Upload UI dist + uses: actions/upload-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + retention-days: 30 + lint-kits: + name: Lint - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Lint Kits package + run: pnpm --filter @ermnvldmr/kits lint + typecheck-kits: + name: Typecheck - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Typecheck Kits package + run: pnpm --filter @ermnvldmr/kits typecheck + test-kits: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Test Kits package + run: pnpm --filter @ermnvldmr/kits test:coverage + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Build Kits Storybook + run: pnpm --filter @ermnvldmr/kits build-storybook + - name: Upload Storybook build + uses: actions/upload-artifact@v4 + with: + name: kits-storybook-static-${{ github.run_id }} + path: packages/kits/storybook-static/ + retention-days: 30 + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium + - name: Download Storybook build + uses: actions/download-artifact@v4 + with: + name: kits-storybook-static-${{ github.run_id }} + path: packages/kits/storybook-static/ + - name: Test Storybook + run: pnpm --filter @ermnvldmr/kits test:storybook:ci + build-kits: + name: Build - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Build Kits package + run: pnpm --filter @ermnvldmr/kits build diff --git a/.gitea/workflows/packages-kits-pr-required.yml b/.gitea/workflows/packages-kits-pr-required.yml new file mode 100644 index 0000000..fd81a3d --- /dev/null +++ b/.gitea/workflows/packages-kits-pr-required.yml @@ -0,0 +1,332 @@ +name: packages/kits - pr/required +'on': + pull_request: + branches: + - next + paths: + - packages/kits/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/packages-kits-pr-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-pr-kits-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs & UI + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Build UI + run: pnpm --filter @ermnvldmr/ui build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + retention-days: 30 + - name: Upload UI dist + uses: actions/upload-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + retention-days: 30 + lint-kits: + name: Lint - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Lint Kits package + run: pnpm --filter @ermnvldmr/kits lint + typecheck-kits: + name: Typecheck - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Typecheck Kits package + run: pnpm --filter @ermnvldmr/kits typecheck + test-kits: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Test Kits package + run: pnpm --filter @ermnvldmr/kits test:coverage + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Build Kits Storybook + run: pnpm --filter @ermnvldmr/kits build-storybook + - name: Upload Storybook build + uses: actions/upload-artifact@v4 + with: + name: kits-storybook-static-${{ github.run_id }} + path: packages/kits/storybook-static/ + retention-days: 30 + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium + - name: Download Storybook build + uses: actions/download-artifact@v4 + with: + name: kits-storybook-static-${{ github.run_id }} + path: packages/kits/storybook-static/ + - name: Test Storybook + run: pnpm --filter @ermnvldmr/kits test:storybook:ci + build-kits: + name: Build - Kits + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download UI dist + uses: actions/download-artifact@v4 + with: + name: ui-dist-${{ github.run_id }} + path: packages/ui/dist + - name: Build Kits package + run: pnpm --filter @ermnvldmr/kits build diff --git a/.gitea/workflows/packages-ssg-next-required.yml b/.gitea/workflows/packages-ssg-next-required.yml new file mode 100644 index 0000000..e9def20 --- /dev/null +++ b/.gitea/workflows/packages-ssg-next-required.yml @@ -0,0 +1,133 @@ +name: packages/ssg - next/required +'on': + push: + branches: + - next + paths: + - packages/ssg/** + - .gitea/workflows/packages-ssg-next-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-ssg-${{ github.ref_name }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + retention-days: 30 + lint-ssg: + name: Lint - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Lint SSG package + run: pnpm --filter @ermnvldmr/ssg lint + typecheck-ssg: + name: Typecheck - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Typecheck SSG package + run: pnpm --filter @ermnvldmr/ssg typecheck + build-ssg: + name: Build - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Build SSG package + run: pnpm --filter @ermnvldmr/ssg build diff --git a/.gitea/workflows/packages-ssg-pr-required.yml b/.gitea/workflows/packages-ssg-pr-required.yml new file mode 100644 index 0000000..82640a6 --- /dev/null +++ b/.gitea/workflows/packages-ssg-pr-required.yml @@ -0,0 +1,133 @@ +name: packages/ssg - pr/required +'on': + pull_request: + branches: + - next + paths: + - packages/ssg/** + - .gitea/workflows/packages-ssg-pr-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-pr-ssg-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + lint-ssg: + name: Lint - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Lint SSG package + run: pnpm --filter @ermnvldmr/ssg lint + typecheck-ssg: + name: Typecheck - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Typecheck SSG package + run: pnpm --filter @ermnvldmr/ssg typecheck + build-ssg: + name: Build - SSG + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Build SSG package + run: pnpm --filter @ermnvldmr/ssg build diff --git a/.gitea/workflows/packages-stl-next-required.yml b/.gitea/workflows/packages-stl-next-required.yml new file mode 100644 index 0000000..7489967 --- /dev/null +++ b/.gitea/workflows/packages-stl-next-required.yml @@ -0,0 +1,156 @@ +name: packages/stl - next/required +'on': + push: + branches: + - next + paths: + - packages/stl/** + - .gitea/workflows/packages-stl-next-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-stl-${{ github.ref_name }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + retention-days: 30 + lint-stl: + name: Lint - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Lint STL package + run: pnpm --filter @ermnvldmr/stl lint + typecheck-stl: + name: Typecheck - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Typecheck STL package + run: pnpm --filter @ermnvldmr/stl typecheck + test-stl: + name: Test - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Test STL package + run: pnpm --filter @ermnvldmr/stl test:coverage + build-stl: + name: Build - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Build STL package + run: pnpm --filter @ermnvldmr/stl build diff --git a/.gitea/workflows/packages-stl-pr-required.yml b/.gitea/workflows/packages-stl-pr-required.yml new file mode 100644 index 0000000..8ca45f3 --- /dev/null +++ b/.gitea/workflows/packages-stl-pr-required.yml @@ -0,0 +1,157 @@ +name: packages/stl - pr/required +'on': + pull_request: + branches: + - next + paths: + - packages/stl/** + - .gitea/workflows/packages-stl-pr-required.yml + - pnpm-lock.yaml + - ci/scripts/** + workflow_dispatch: {} +concurrency: + group: ci-pr-stl-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + lint-stl: + name: Lint - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Lint STL package + run: pnpm --filter @ermnvldmr/stl lint + typecheck-stl: + name: Typecheck - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Typecheck STL package + run: pnpm --filter @ermnvldmr/stl typecheck + test-stl: + name: Test - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Test STL package + run: pnpm --filter @ermnvldmr/stl test:coverage + build-stl: + name: Build - STL + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Build STL package + run: pnpm --filter @ermnvldmr/stl build diff --git a/.gitea/workflows/packages-ui-next-required.yml b/.gitea/workflows/packages-ui-next-required.yml new file mode 100644 index 0000000..a0ff28c --- /dev/null +++ b/.gitea/workflows/packages-ui-next-required.yml @@ -0,0 +1,284 @@ +name: packages/ui - next/required +'on': + push: + branches: + - next + paths: + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/packages-ui-next-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-ui-${{ github.ref_name }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + retention-days: 30 + lint-ui: + name: Lint - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Lint UI package + run: pnpm --filter @ermnvldmr/ui lint + typecheck-ui: + name: Typecheck - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Typecheck UI package + run: pnpm --filter @ermnvldmr/ui typecheck + test-ui: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Test UI package + run: pnpm --filter @ermnvldmr/ui test:coverage + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Build UI Storybook + run: pnpm --filter @ermnvldmr/ui build-storybook + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium + - name: Build UI Storybook + run: pnpm --filter @ermnvldmr/ui build-storybook + - name: Test Storybook + run: pnpm --filter @ermnvldmr/ui test:storybook:ci + build-ui: + name: Build - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Build UI package + run: pnpm --filter @ermnvldmr/ui build diff --git a/.gitea/workflows/packages-ui-pr-required.yml b/.gitea/workflows/packages-ui-pr-required.yml new file mode 100644 index 0000000..8225d2e --- /dev/null +++ b/.gitea/workflows/packages-ui-pr-required.yml @@ -0,0 +1,293 @@ +name: packages/ui - pr/required +'on': + pull_request: + branches: + - next + paths: + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/packages-ui-pr-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-pr-ui-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + retention-days: 30 + lint-ui: + name: Lint - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Lint UI package + run: pnpm --filter @ermnvldmr/ui lint + typecheck-ui: + name: Typecheck - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Typecheck UI package + run: pnpm --filter @ermnvldmr/ui typecheck + test-ui: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Test UI package + run: pnpm --filter @ermnvldmr/ui test:coverage + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Build UI Storybook + run: pnpm --filter @ermnvldmr/ui build-storybook + - name: Upload Storybook build + uses: actions/upload-artifact@v4 + with: + name: ui-storybook-static-${{ github.run_id }} + path: packages/ui/storybook-static/ + retention-days: 30 + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium + - name: Download Storybook build + uses: actions/download-artifact@v4 + with: + name: ui-storybook-static-${{ github.run_id }} + path: packages/ui/storybook-static/ + - name: Test Storybook + run: pnpm --filter @ermnvldmr/ui test:storybook:ci + build-ui: + name: Build - UI + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Build UI package + run: pnpm --filter @ermnvldmr/ui build diff --git a/.gitea/workflows/services-docs-next-required.yml b/.gitea/workflows/services-docs-next-required.yml new file mode 100644 index 0000000..a57f060 --- /dev/null +++ b/.gitea/workflows/services-docs-next-required.yml @@ -0,0 +1,129 @@ +name: services/docs - next/required +'on': + push: + branches: + - next + paths: + - services/docs/** + - .gitea/workflows/services-docs-next-required.yml + - ci/docker/docs/** + - ci/config/nginx/** + - ci/scripts/** + workflow_dispatch: + +concurrency: + group: ci-docs-${{ github.ref_name }} + cancel-in-progress: true + +permissions: + contents: read + actions: read + +jobs: + setup-hugo: + name: Setup - Hugo + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + - name: Setup Hugo + run: hugo version | grep extended + + build-hugo: + name: Build - Hugo Site + needs: setup-hugo + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + - name: Setup Hugo + run: hugo version | grep extended + - name: Build Hugo site + working-directory: services/docs + run: hugo --gc --minify + + release-docker: + name: Release - Docker Image + needs: build-hugo + runs-on: apex-debian13 + permissions: + contents: read + packages: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + fetch-depth: 0 + - name: Log in to Gitea Container Registry + run: python3 ci/scripts/docker.py login + env: + REGISTRY: git.ermnvldmr.com + REGISTRY_USER: ${{ github.repository_owner }} + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} + - name: Extract Docker metadata + id: meta + run: python3 ci/scripts/docker.py metadata + env: + IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs + TAG_RULES: | + type=raw,value=latest + type=sha,format=short + SOURCE_SHA: ${{ github.sha }} + - name: Compute short SHA + id: vars + run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT + - name: Build and push Docker image + run: python3 ci/scripts/docker.py build + env: + TAGS: ${{ steps.meta.outputs.tags }} + LABELS: ${{ steps.meta.outputs.labels }} + BUILD_ARGS: | + COMMIT_SHA=${{ steps.vars.outputs.short_sha }} + VERSION=${{ steps.vars.outputs.short_sha }} + DOCKERFILE: ci/docker/docs/Dockerfile + PLATFORMS: '' + PUSH: 'true' + CONTEXT: . + SOURCE_SHA: ${{ github.sha }} + RUN_ID: ${{ github.run_id }} + + deploy: + name: Deploy - Kubernetes (GitOps) + needs: release-docker + runs-on: apex-debian13 + if: github.event_name == 'push' && github.ref == 'refs/heads/next' + permissions: + contents: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + ref: next + - name: Setup Kustomize + run: test "$(kustomize version)" = v5.3.0 + - name: Deploy via GitOps + run: | + DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)" + bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}" + env: + GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }} + + verify-rollout: + name: Verify - Production Rollout + needs: deploy + runs-on: apex-debian13 + if: github.event_name == 'push' && github.ref == 'refs/heads/next' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + ref: next + - name: Await production rollout + run: | + DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)" + bash ci/scripts/await-rollout.sh docs "${DOCS_TAG}" diff --git a/.gitea/workflows/services-docs-pr-required.yml b/.gitea/workflows/services-docs-pr-required.yml new file mode 100644 index 0000000..64337b6 --- /dev/null +++ b/.gitea/workflows/services-docs-pr-required.yml @@ -0,0 +1,40 @@ +name: services/docs - pr/required +'on': + pull_request: + branches: + - next + paths: + - services/docs/** + - .gitea/workflows/services-docs-pr-required.yml + - ci/scripts/** +concurrency: + group: ci-pr-docs-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-hugo: + name: Setup - Hugo + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + - name: Setup Hugo + run: hugo version | grep extended + build-hugo: + name: Build - Hugo Site + needs: setup-hugo + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + - name: Setup Hugo + run: hugo version | grep extended + - name: Build Hugo site + working-directory: services/docs + run: hugo --gc --minify diff --git a/.gitea/workflows/services-static-next-required.yml b/.gitea/workflows/services-static-next-required.yml new file mode 100644 index 0000000..a763cc3 --- /dev/null +++ b/.gitea/workflows/services-static-next-required.yml @@ -0,0 +1,195 @@ +name: services/static - next/required +'on': + push: + branches: + - next + paths: + - services/static/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/services-static-next-required.yml + - ci/scripts/** + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-static-${{ github.ref_name }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + retention-days: 30 + lint-static: + name: Lint - Static + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Lint static service + run: pnpm --filter @ermnvldmr/static lint + typecheck-static: + name: Typecheck - Static + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Typecheck static service + run: pnpm --filter @ermnvldmr/static typecheck + build-static: + name: Build - Static Site + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Build static service + run: pnpm --filter @ermnvldmr/static build + - name: Upload build artifacts + uses: actions/upload-artifact@v4 + with: + name: static-dist + path: services/static/dist/ + retention-days: 30 + deploy-s3: + name: Deploy - S3 + needs: + - lint-static + - typecheck-static + - build-static + runs-on: apex-debian13 + if: github.event_name == 'push' && github.ref == 'refs/heads/next' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Download build artifacts + uses: actions/download-artifact@v4 + with: + name: static-dist + path: services/static/dist/ + - name: Deploy to S3 + env: + AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }} + AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }} + S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }} + AWS_REGION: ${{ secrets.STATIC_AWS_REGION }} + S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }} + run: 'chmod +x ci/scripts/deploy-static.sh + + ./ci/scripts/deploy-static.sh + + ' diff --git a/.gitea/workflows/services-static-pr-required.yml b/.gitea/workflows/services-static-pr-required.yml new file mode 100644 index 0000000..08e7e51 --- /dev/null +++ b/.gitea/workflows/services-static-pr-required.yml @@ -0,0 +1,166 @@ +name: services/static - pr/required +'on': + pull_request: + branches: + - next + paths: + - services/static/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/services-static-pr-required.yml + - ci/scripts/** + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-pr-static-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build i18n + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload Config Artifacts + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + retention-days: 30 + lint-static: + name: Lint - Static + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Lint static service + run: pnpm --filter @ermnvldmr/static lint + typecheck-static: + name: Typecheck - Static + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Typecheck static service + run: pnpm --filter @ermnvldmr/static typecheck + build-static: + name: Build - Static Site + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Config Artifacts + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Build static service + run: pnpm --filter @ermnvldmr/static build + - name: Upload build artifacts + uses: actions/upload-artifact@v4 + with: + name: static-dist-${{ github.run_id }} + path: services/static/dist/ + retention-days: 30 diff --git a/.gitea/workflows/services-www-deploy-manual.yml b/.gitea/workflows/services-www-deploy-manual.yml new file mode 100644 index 0000000..1ff826e --- /dev/null +++ b/.gitea/workflows/services-www-deploy-manual.yml @@ -0,0 +1,76 @@ +name: services/www - manual deploy +'on': + workflow_dispatch: + inputs: + tested_sha: + description: Full tested source commit + required: true + type: string + tested_digest: + description: OCI sha256 digest from the successful build + required: true + type: string + build_run_id: + description: Successful WWW build run ID + required: true + type: string + release_tag: + description: Previously approved release tag + required: true + type: string + release_run_id: + description: Successful manually approved release run ID + required: true + type: string +permissions: + contents: read + actions: read +jobs: + deploy: + runs-on: apex-debian13 + if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next' + && github.actor == 'deytenit' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Authenticate local registry + run: python3 ci/scripts/docker.py login + env: + REGISTRY: git.ermnvldmr.com + REGISTRY_USER: deytenit + REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_READ_TOKEN }} + - name: Verify successful build and immutable digest + id: provenance + run: python3 ci/scripts/provenance.py + env: + TESTED_SHA: ${{ inputs.tested_sha }} + TESTED_DIGEST: ${{ inputs.tested_digest }} + BUILD_RUN_ID: ${{ inputs.build_run_id }} + PROVENANCE_TOKEN: ${{ github.token }} + RELEASE_RUN_ID: ${{ inputs.release_run_id }} + RELEASE_TAG: ${{ inputs.release_tag }} + - name: Verify approved release and deploy digest + env: + TESTED_SHA: ${{ inputs.tested_sha }} + TESTED_DIGEST: ${{ inputs.tested_digest }} + BUILD_RUN_ID: ${{ inputs.build_run_id }} + PROVENANCE_TOKEN: ${{ github.token }} + RELEASE_RUN_ID: ${{ inputs.release_run_id }} + RELEASE_TAG: ${{ inputs.release_tag }} + GIT_WRITE_KEY: ${{ secrets.WWW_DEPLOY_KEY }} + run: 'set -euo pipefail + + [[ "$RELEASE_TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] + + test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$TESTED_SHA" + + test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$RELEASE_TAG" + --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST" + + bash ci/scripts/deploy-gitops.sh www "$TESTED_DIGEST" + + ' + - name: Await production rollout + run: bash ci/scripts/await-rollout.sh https://www.ermnvldmr.com/version.json "sha-${TESTED_SHA:0:7}" + env: + TESTED_SHA: ${{ inputs.tested_sha }} diff --git a/.gitea/workflows/services-www-next-required.yml b/.gitea/workflows/services-www-next-required.yml new file mode 100644 index 0000000..e0a407a --- /dev/null +++ b/.gitea/workflows/services-www-next-required.yml @@ -0,0 +1,381 @@ +name: services/www - next/required +'on': + push: + branches: + - next + paths: + - services/www/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/services-www-next-required.yml + - ci/docker/www/** + - ci/config/nginx/** + - ci/scripts/** + - pnpm-lock.yaml + - ci/scripts/** + workflow_dispatch: null +concurrency: + group: ci-www-${{ github.ref_name }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + retention-days: 30 + - name: Build i18n package + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + retention-days: 30 + lint-www: + name: Lint - WWW + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Lint WWW service + run: pnpm --filter @ermnvldmr/www lint + typecheck-www: + name: Typecheck - WWW + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Typecheck WWW service + run: pnpm --filter @ermnvldmr/www typecheck + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Build WWW Storybook + run: pnpm --filter @ermnvldmr/www build-storybook + - name: Upload Storybook build + uses: actions/upload-artifact@v4 + with: + name: storybook-static + path: services/www/storybook-static/ + retention-days: 30 + test-www: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Test WWW service + run: pnpm --filter @ermnvldmr/www test:coverage + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium + - name: Download Storybook build + uses: actions/download-artifact@v4 + with: + name: storybook-static + path: services/www/storybook-static/ + - name: Serve Storybook and run tests with coverage + run: pnpm --filter @ermnvldmr/www test:storybook:ci + build-www: + name: Build - WWW Service + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist + path: packages/storybook-config/dist + - name: Build WWW service (all locales) + run: pnpm --filter @ermnvldmr/www build:all + env: + RSDOCTOR: 'true' + - name: Upload Rsdoctor report + uses: actions/upload-artifact@v4 + with: + name: rsdoctor-report + path: services/www/rsdoctor/ + retention-days: 30 + build-docker: + name: Build - Docker Image + needs: + - lint-www + - typecheck-www + - test-www + - test-storybook + - build-www + runs-on: apex-debian13 + permissions: + contents: read + packages: write + outputs: + short_sha: ${{ steps.vars.outputs.short_sha }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Calculate Short SHA + id: vars + run: 'SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)" + + echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT + + ' + - name: Log in to GitHub Container Registry + run: python3 ci/scripts/docker.py login + env: + REGISTRY: git.ermnvldmr.com + REGISTRY_USER: ${{ github.repository_owner }} + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} + - name: Set up Docker Buildx + run: 'docker buildx version + + docker buildx create --name apex-ci --driver docker-container --use + + docker buildx inspect --bootstrap' + - name: Build and push Docker image + run: python3 ci/scripts/docker.py build + env: + TAGS: git.ermnvldmr.com/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha + }} + LABELS: '' + BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }} + + VERSION=${{ steps.vars.outputs.short_sha }} + + ' + DOCKERFILE: ci/docker/www/Dockerfile + PLATFORMS: '' + PUSH: 'true' + CONTEXT: . + SOURCE_SHA: ${{ github.sha }} + RUN_ID: ${{ github.run_id }} + id: image + - name: Record tested digest provenance + env: + IMAGE_DIGEST: ${{ steps.image.outputs.digest }} + run: 'mkdir -p .ci + + python3 - <<''PROVENANCE'' + + import json, os + + from pathlib import Path + + Path(''.ci/www-provenance.json'').write_text(json.dumps({''sha'': os.environ[''GITHUB_SHA''], + ''digest'': os.environ[''IMAGE_DIGEST''], ''run_id'': os.environ[''GITHUB_RUN_ID''], + ''repository'': os.environ[''GITHUB_REPOSITORY'']})) + + PROVENANCE' + - uses: actions/upload-artifact@v4 + with: + name: www-provenance + path: .ci/www-provenance.json + retention-days: 30 diff --git a/.gitea/workflows/services-www-pr-required.yml b/.gitea/workflows/services-www-pr-required.yml new file mode 100644 index 0000000..fbe73e1 --- /dev/null +++ b/.gitea/workflows/services-www-pr-required.yml @@ -0,0 +1,302 @@ +name: services/www - pr/required +'on': + pull_request: + branches: + - next + paths: + - services/www/** + - packages/ui/** + - packages/stl/** + - packages/i18n/** + - .gitea/workflows/services-www-pr-required.yml + - pnpm-lock.yaml + - ci/scripts/** +concurrency: + group: ci-pr-www-${{ github.head_ref }} + cancel-in-progress: true +permissions: + contents: read + actions: read +jobs: + setup-stage: + name: Setup - Stage + runs-on: apex-debian13 + outputs: {} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Pack dependency cache + run: python3 ci/scripts/cache.py pack + - uses: actions/upload-artifact@v4 + with: + name: ${{ steps.dependency-cache.outputs.key }} + path: .ci/pnpm-store.tar + retention-days: 7 + build-configs: + name: Build - Configs + needs: setup-stage + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Build Rsbuild config + run: pnpm --filter @ermnvldmr/rsbuild-config build + - name: Build Storybook config + run: pnpm --filter @ermnvldmr/storybook-config build + - name: Upload Rsbuild Config + uses: actions/upload-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + retention-days: 30 + - name: Upload Storybook Config + uses: actions/upload-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + retention-days: 30 + - name: Build i18n package + run: pnpm --filter @ermnvldmr/i18n build + - name: Upload i18n dist + uses: actions/upload-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + retention-days: 30 + lint-www: + name: Lint - WWW + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Lint WWW service + run: pnpm --filter @ermnvldmr/www lint + typecheck-www: + name: Typecheck - WWW + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Typecheck WWW service + run: pnpm --filter @ermnvldmr/www typecheck + build-storybook: + name: Build - Storybook + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Build WWW Storybook + run: pnpm --filter @ermnvldmr/www build-storybook + - name: Upload Storybook build + uses: actions/upload-artifact@v4 + with: + name: www-storybook-static-${{ github.run_id }} + path: services/www/storybook-static/ + retention-days: 30 + test-www: + name: Test - Unit + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Test WWW service + run: pnpm --filter @ermnvldmr/www test:coverage + test-storybook: + name: Test - Storybook + needs: build-storybook + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Install Playwright browsers + run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium + - name: Download Storybook build + uses: actions/download-artifact@v4 + with: + name: www-storybook-static-${{ github.run_id }} + path: services/www/storybook-static/ + - name: Serve Storybook and run tests with coverage + run: pnpm --filter @ermnvldmr/www test:storybook:ci + build-www: + name: Build - WWW Service + needs: build-configs + runs-on: apex-debian13 + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup environment + run: bash ci/scripts/setup-env.sh 9.12.3 20 + - name: Restore repository dependency cache + id: dependency-cache + run: python3 ci/scripts/cache.py restore + env: + CACHE_TOKEN: ${{ github.token }} + - name: Install dependencies + run: pnpm install --frozen-lockfile + - name: Download Rsbuild Config + uses: actions/download-artifact@v4 + with: + name: rsbuild-config-dist-${{ github.run_id }} + path: packages/rsbuild-config/dist + - name: Download i18n dist + uses: actions/download-artifact@v4 + with: + name: i18n-dist-${{ github.run_id }} + path: packages/i18n/dist + - name: Download Storybook Config + uses: actions/download-artifact@v4 + with: + name: storybook-config-dist-${{ github.run_id }} + path: packages/storybook-config/dist + - name: Build WWW service (all locales) + run: pnpm --filter @ermnvldmr/www build:all + env: + RSDOCTOR: 'true' + - name: Upload Rsdoctor report + uses: actions/upload-artifact@v4 + with: + name: rsdoctor-report-${{ github.run_id }} + path: services/www/rsdoctor/ + retention-days: 30 diff --git a/.gitea/workflows/services-www-release-manual.yml b/.gitea/workflows/services-www-release-manual.yml new file mode 100644 index 0000000..07880ea --- /dev/null +++ b/.gitea/workflows/services-www-release-manual.yml @@ -0,0 +1,88 @@ +name: services/www - manual release +'on': + workflow_dispatch: + inputs: + tested_sha: + description: Full tested source commit + required: true + type: string + tested_digest: + description: OCI sha256 digest from the successful build + required: true + type: string + build_run_id: + description: Successful WWW build run ID + required: true + type: string +permissions: + contents: read + actions: read +jobs: + release: + runs-on: apex-debian13 + if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next' + && github.actor == 'deytenit' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Authenticate local registry + run: python3 ci/scripts/docker.py login + env: + REGISTRY: git.ermnvldmr.com + REGISTRY_USER: deytenit + REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }} + - name: Verify successful build and immutable digest + id: provenance + run: python3 ci/scripts/provenance.py + env: + TESTED_SHA: ${{ inputs.tested_sha }} + TESTED_DIGEST: ${{ inputs.tested_digest }} + BUILD_RUN_ID: ${{ inputs.build_run_id }} + PROVENANCE_TOKEN: ${{ github.token }} + - name: Promote tested digest and create release tag + env: + TESTED_SHA: ${{ inputs.tested_sha }} + TESTED_DIGEST: ${{ inputs.tested_digest }} + BUILD_RUN_ID: ${{ inputs.build_run_id }} + PROVENANCE_TOKEN: ${{ github.token }} + GIT_WRITE_KEY: ${{ secrets.WWW_RELEASE_KEY }} + run: 'set -euo pipefail + + VERSION=$(bash ci/scripts/calver-release.sh) + + [[ "$VERSION" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] + + if git show-ref --verify --quiet "refs/tags/$VERSION"; then exit 1; fi + + docker buildx imagetools create --prefer-index=false "git.ermnvldmr.com/deytenit/ermnvldmr.com/www@$TESTED_DIGEST" + --tag "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION" + + test "$(docker buildx imagetools inspect "git.ermnvldmr.com/deytenit/ermnvldmr.com/www:$VERSION" + --format ''{{.Manifest.Digest}}'')" = "$TESTED_DIGEST" + + git tag "$VERSION" "$TESTED_SHA" + + python3 ci/scripts/git_write.py "refs/tags/$VERSION" + + export VERSION + + mkdir -p .ci + + python3 - <<''RELEASE_PROVENANCE'' + + import json, os + + from pathlib import Path + + Path(''.ci/www-release.json'').write_text(json.dumps({''sha'': os.environ[''TESTED_SHA''], + ''digest'': os.environ[''TESTED_DIGEST''], ''run_id'': os.environ[''BUILD_RUN_ID''], + ''repository'': ''deytenit/ermnvldmr.com'', ''release_tag'': os.environ[''VERSION'']})) + + RELEASE_PROVENANCE + + ' + - uses: actions/upload-artifact@v4 + with: + name: www-release-provenance + path: .ci/www-release.json + retention-days: 30 diff --git a/.github/workflows/ci-next-build-golden-image.yml b/.github/workflows/ci-next-build-golden-image.yml deleted file mode 100644 index 484d037..0000000 --- a/.github/workflows/ci-next-build-golden-image.yml +++ /dev/null @@ -1,134 +0,0 @@ -name: ci - next/build-golden-image - -on: - workflow_dispatch: - -concurrency: - group: ci-golden-image - cancel-in-progress: false - -permissions: - contents: read - -jobs: - validate-scripts: - name: Validate - Provisioner Scripts - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Validate Shell Script Syntax - run: bash -n ci/packer/scripts/*.sh - - build-image: - name: Build - Golden Image - needs: validate-scripts - runs-on: ubuntu-latest - outputs: - image_name: ${{ steps.vars.outputs.image_name }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Calculate Image Name - id: vars - run: | - SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)" - IMAGE_NAME="com-ermnvldmr-debian-12-k3s-amd64-${SHORT_SHA}.qcow2" - echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT" - - - name: Install Build Tools - run: | - sudo apt-get update - sudo apt-get install -y qemu-utils - - - name: Build Debian K3s Golden Image - run: | - mkdir -p output-qemu - echo "Downloading official Debian 12 cloud image..." - curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2 - - echo "Expanding disk image to 10G..." - qemu-img resize base.qcow2 10G - - echo "Connecting disk image via NBD..." - sudo modprobe nbd max_part=8 - sudo qemu-nbd --connect=/dev/nbd0 base.qcow2 - sleep 1 - sudo partx -u /dev/nbd0 || true - - echo "Mounting disk filesystem..." - sudo mkdir -p /mnt/target - sudo mount /dev/nbd0p1 /mnt/target - - echo "Mounting host virtual filesystems and configuring DNS..." - sudo rm -f /mnt/target/etc/resolv.conf - echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf - echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf - sudo mount --bind /dev /mnt/target/dev - sudo mount --bind /dev/pts /mnt/target/dev/pts - sudo mount --bind /proc /mnt/target/proc - sudo mount --bind /sys /mnt/target/sys - - echo "Copying provisioner scripts..." - sudo mkdir -p /mnt/target/tmp/scripts - sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/ - sudo chmod +x /mnt/target/tmp/scripts/*.sh - - echo "Running provisioner scripts in chroot..." - sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh - sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh - sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh - sudo rm -rf /mnt/target/tmp/scripts - - echo "Unmounting filesystems..." - sudo umount /mnt/target/sys - sudo umount /mnt/target/proc - sudo umount /mnt/target/dev/pts - sudo umount /mnt/target/dev - sudo umount /mnt/target - sudo qemu-nbd --disconnect /dev/nbd0 - - echo "Compressing and optimizing qcow2 with 2M cluster size..." - qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 - echo "Golden image built successfully." - - - name: Prepare and Upload Image Artifact - uses: actions/upload-artifact@v4 - with: - name: golden-image - path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 - retention-days: 1 - - upload-s3: - name: Upload - S3 Storage - needs: build-image - runs-on: ubuntu-latest - steps: - - name: Download Image Artifact - uses: actions/download-artifact@v4 - with: - name: golden-image - path: output-qemu - - - name: Upload to Static S3 (/dev/images/) - env: - AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }} - AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'auto' }} - S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }} - S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }} - IMAGE_NAME: ${{ needs.build-image.outputs.image_name }} - run: | - mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 "output-qemu/${IMAGE_NAME}" - if [ -n "${S3_BUCKET}" ] && [ -n "${AWS_ACCESS_KEY_ID}" ]; then - ENDPOINT_FLAG="" - [ -n "${S3_ENDPOINT}" ] && ENDPOINT_FLAG="--endpoint-url=${S3_ENDPOINT}" - echo "Cleaning up older images in dev/images/ to free bucket storage..." - aws ${ENDPOINT_FLAG} s3 rm "s3://${S3_BUCKET}/dev/images/" --recursive --exclude "*" --include "com-ermnvldmr-debian-12-k3s-*.qcow2" || true - aws ${ENDPOINT_FLAG} s3 cp "output-qemu/${IMAGE_NAME}" "s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}" - echo "Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}" - else - echo "S3 storage secrets not provided; skipping remote S3 upload. Image artifact is preserved in GitHub Actions run artifacts." - fi diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index e82c545..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: CodeQL - -on: - push: - branches: [next] - paths-ignore: - - '**/kustomization.yaml' - pull_request: - branches: [next] - paths-ignore: - - '**/kustomization.yaml' - schedule: - - cron: '43 8 * * 3' - -concurrency: - group: codeql-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - security-events: write - actions: read - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - contents: read - security-events: write - actions: read - - strategy: - fail-fast: false - matrix: - language: ['actions', 'javascript-typescript'] - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/packages-kits-next-required.yml b/.github/workflows/packages-kits-next-required.yml deleted file mode 100644 index f90b5fc..0000000 --- a/.github/workflows/packages-kits-next-required.yml +++ /dev/null @@ -1,361 +0,0 @@ -name: packages/kits - next/required - -on: - push: - branches: [next] - paths: - - 'packages/kits/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/packages-kits-next-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-next-kits-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs & UI - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Build UI - run: pnpm --filter @ermnvldmr/ui build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - retention-days: 1 - - name: Upload UI dist - uses: actions/upload-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - retention-days: 1 - - lint-kits: - name: Lint - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Lint Kits package - run: pnpm --filter @ermnvldmr/kits lint - - typecheck-kits: - name: Typecheck - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Typecheck Kits package - run: pnpm --filter @ermnvldmr/kits typecheck - - test-kits: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Test Kits package - run: pnpm --filter @ermnvldmr/kits test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/kits/coverage/lcov.info - flags: kits - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Build Kits Storybook - run: pnpm --filter @ermnvldmr/kits build-storybook - - name: Upload Storybook build - uses: actions/upload-artifact@v4 - with: - name: kits-storybook-static-${{ github.run_id }} - path: packages/kits/storybook-static/ - retention-days: 1 - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium - - name: Download Storybook build - uses: actions/download-artifact@v4 - with: - name: kits-storybook-static-${{ github.run_id }} - path: packages/kits/storybook-static/ - - name: Test Storybook - run: pnpm --filter @ermnvldmr/kits test:storybook:ci - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/kits/coverage/storybook/lcov.info - flags: kits-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-kits: - name: Build - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Build Kits package - run: pnpm --filter @ermnvldmr/kits build diff --git a/.github/workflows/packages-kits-pr-required.yml b/.github/workflows/packages-kits-pr-required.yml deleted file mode 100644 index 152a011..0000000 --- a/.github/workflows/packages-kits-pr-required.yml +++ /dev/null @@ -1,361 +0,0 @@ -name: packages/kits - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'packages/kits/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/packages-kits-pr-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-kits-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs & UI - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Build UI - run: pnpm --filter @ermnvldmr/ui build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - retention-days: 1 - - name: Upload UI dist - uses: actions/upload-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - retention-days: 1 - - lint-kits: - name: Lint - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Lint Kits package - run: pnpm --filter @ermnvldmr/kits lint - - typecheck-kits: - name: Typecheck - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Typecheck Kits package - run: pnpm --filter @ermnvldmr/kits typecheck - - test-kits: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Test Kits package - run: pnpm --filter @ermnvldmr/kits test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/kits/coverage/lcov.info - flags: kits - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Build Kits Storybook - run: pnpm --filter @ermnvldmr/kits build-storybook - - name: Upload Storybook build - uses: actions/upload-artifact@v4 - with: - name: kits-storybook-static-${{ github.run_id }} - path: packages/kits/storybook-static/ - retention-days: 1 - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium - - name: Download Storybook build - uses: actions/download-artifact@v4 - with: - name: kits-storybook-static-${{ github.run_id }} - path: packages/kits/storybook-static/ - - name: Test Storybook - run: pnpm --filter @ermnvldmr/kits test:storybook:ci - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/kits/coverage/storybook/lcov.info - flags: kits-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-kits: - name: Build - Kits - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download UI dist - uses: actions/download-artifact@v4 - with: - name: ui-dist-${{ github.run_id }} - path: packages/ui/dist - - name: Build Kits package - run: pnpm --filter @ermnvldmr/kits build diff --git a/.github/workflows/packages-ssg-next-required.yml b/.github/workflows/packages-ssg-next-required.yml deleted file mode 100644 index 731cf22..0000000 --- a/.github/workflows/packages-ssg-next-required.yml +++ /dev/null @@ -1,145 +0,0 @@ -name: packages/ssg - next/required - -on: - push: - branches: [next] - paths: - - 'packages/ssg/**' - - '.github/workflows/packages-ssg-next-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-ssg-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - retention-days: 1 - - lint-ssg: - name: Lint - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Lint SSG package - run: pnpm --filter @ermnvldmr/ssg lint - - typecheck-ssg: - name: Typecheck - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Typecheck SSG package - run: pnpm --filter @ermnvldmr/ssg typecheck - - build-ssg: - name: Build - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Build SSG package - run: pnpm --filter @ermnvldmr/ssg build diff --git a/.github/workflows/packages-ssg-pr-required.yml b/.github/workflows/packages-ssg-pr-required.yml deleted file mode 100644 index 6973034..0000000 --- a/.github/workflows/packages-ssg-pr-required.yml +++ /dev/null @@ -1,145 +0,0 @@ -name: packages/ssg - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'packages/ssg/**' - - '.github/workflows/packages-ssg-pr-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-ssg-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - lint-ssg: - name: Lint - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Lint SSG package - run: pnpm --filter @ermnvldmr/ssg lint - - typecheck-ssg: - name: Typecheck - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Typecheck SSG package - run: pnpm --filter @ermnvldmr/ssg typecheck - - build-ssg: - name: Build - SSG - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Build SSG package - run: pnpm --filter @ermnvldmr/ssg build diff --git a/.github/workflows/packages-stl-next-required.yml b/.github/workflows/packages-stl-next-required.yml deleted file mode 100644 index 5a8d65d..0000000 --- a/.github/workflows/packages-stl-next-required.yml +++ /dev/null @@ -1,176 +0,0 @@ -name: packages/stl - next/required - -on: - push: - branches: [next] - paths: - - 'packages/stl/**' - - '.github/workflows/packages-stl-next-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-stl-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - retention-days: 1 - - lint-stl: - name: Lint - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Lint STL package - run: pnpm --filter @ermnvldmr/stl lint - - typecheck-stl: - name: Typecheck - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Typecheck STL package - run: pnpm --filter @ermnvldmr/stl typecheck - - test-stl: - name: Test - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Test STL package - run: pnpm --filter @ermnvldmr/stl test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/stl/coverage/lcov.info - flags: stl - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-stl: - name: Build - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Build STL package - run: pnpm --filter @ermnvldmr/stl build diff --git a/.github/workflows/packages-stl-pr-required.yml b/.github/workflows/packages-stl-pr-required.yml deleted file mode 100644 index 184ce60..0000000 --- a/.github/workflows/packages-stl-pr-required.yml +++ /dev/null @@ -1,176 +0,0 @@ -name: packages/stl - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'packages/stl/**' - - '.github/workflows/packages-stl-pr-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-stl-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - lint-stl: - name: Lint - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Lint STL package - run: pnpm --filter @ermnvldmr/stl lint - - typecheck-stl: - name: Typecheck - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Typecheck STL package - run: pnpm --filter @ermnvldmr/stl typecheck - - test-stl: - name: Test - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Test STL package - run: pnpm --filter @ermnvldmr/stl test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/stl/coverage/lcov.info - flags: stl - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-stl: - name: Build - STL - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Build STL package - run: pnpm --filter @ermnvldmr/stl build diff --git a/.github/workflows/packages-ui-next-required.yml b/.github/workflows/packages-ui-next-required.yml deleted file mode 100644 index ccc1e9e..0000000 --- a/.github/workflows/packages-ui-next-required.yml +++ /dev/null @@ -1,313 +0,0 @@ -name: packages/ui - next/required - -on: - push: - branches: [next] - paths: - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/packages-ui-next-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-ui-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - retention-days: 1 - - lint-ui: - name: Lint - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Lint UI package - run: pnpm --filter @ermnvldmr/ui lint - - typecheck-ui: - name: Typecheck - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Typecheck UI package - run: pnpm --filter @ermnvldmr/ui typecheck - - test-ui: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Test UI package - run: pnpm --filter @ermnvldmr/ui test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/ui/coverage/lcov.info - flags: ui - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Build UI Storybook - run: pnpm --filter @ermnvldmr/ui build-storybook - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium - - name: Build UI Storybook - run: pnpm --filter @ermnvldmr/ui build-storybook - - name: Test Storybook - run: pnpm --filter @ermnvldmr/ui test:storybook:ci - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/ui/coverage/storybook/lcov.info - flags: ui-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-ui: - name: Build - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Build UI package - run: pnpm --filter @ermnvldmr/ui build diff --git a/.github/workflows/packages-ui-pr-required.yml b/.github/workflows/packages-ui-pr-required.yml deleted file mode 100644 index a608820..0000000 --- a/.github/workflows/packages-ui-pr-required.yml +++ /dev/null @@ -1,322 +0,0 @@ -name: packages/ui - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/packages-ui-pr-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-ui-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - retention-days: 1 - - lint-ui: - name: Lint - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Lint UI package - run: pnpm --filter @ermnvldmr/ui lint - - typecheck-ui: - name: Typecheck - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Typecheck UI package - run: pnpm --filter @ermnvldmr/ui typecheck - - test-ui: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Test UI package - run: pnpm --filter @ermnvldmr/ui test:coverage - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/ui/coverage/lcov.info - flags: ui - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Build UI Storybook - run: pnpm --filter @ermnvldmr/ui build-storybook - - name: Upload Storybook build - uses: actions/upload-artifact@v4 - with: - name: ui-storybook-static-${{ github.run_id }} - path: packages/ui/storybook-static/ - retention-days: 1 - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium - - name: Download Storybook build - uses: actions/download-artifact@v4 - with: - name: ui-storybook-static-${{ github.run_id }} - path: packages/ui/storybook-static/ - - name: Test Storybook - run: pnpm --filter @ermnvldmr/ui test:storybook:ci - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./packages/ui/coverage/storybook/lcov.info - flags: ui-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-ui: - name: Build - UI - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Build UI package - run: pnpm --filter @ermnvldmr/ui build diff --git a/.github/workflows/services-docs-next-required.yml b/.github/workflows/services-docs-next-required.yml deleted file mode 100644 index 215c47e..0000000 --- a/.github/workflows/services-docs-next-required.yml +++ /dev/null @@ -1,189 +0,0 @@ -name: services/docs - next/required - -on: - push: - branches: [next] - paths: - - 'services/docs/**' - - '.github/workflows/services-docs-next-required.yml' - - 'ci/docker/docs/**' - - 'ci/config/nginx/**' - - 'ci/scripts/**' - -concurrency: - group: ci-docs-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-hugo: - name: Setup - Hugo - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - fetch-depth: 0 - - - name: Setup Hugo - uses: peaceiris/actions-hugo@v2 - with: - hugo-version: 'latest' - extended: true - - build-hugo: - name: Build - Hugo Site - needs: setup-hugo - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - fetch-depth: 0 - - - name: Setup Hugo - uses: peaceiris/actions-hugo@v2 - with: - hugo-version: 'latest' - extended: true - - - name: Build Hugo site - working-directory: services/docs - run: hugo --gc --minify - - release-docker: - name: Release - Docker Image - needs: build-hugo - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ghcr.io/${{ github.repository }}/docs - tags: | - type=raw,value=latest - type=sha,format=short - - - name: Compute short SHA - id: vars - run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT - - - name: Build and push Docker image - uses: docker/build-push-action@v5 - with: - context: . - file: ci/docker/docs/Dockerfile - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - COMMIT_SHA=${{ steps.vars.outputs.short_sha }} - VERSION=${{ steps.vars.outputs.short_sha }} - - deploy: - name: Deploy - Kubernetes (GitOps) - needs: release-docker - runs-on: ubuntu-latest - if: github.event_name == 'push' && github.ref == 'refs/heads/next' - permissions: - contents: write - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - ref: next - token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }} - - - name: Setup Kustomize - uses: imranismail/setup-kustomize@v2 - with: - kustomize-version: "5.3.0" - - - name: Deploy via GitOps - run: | - DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)" - bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}" - - verify-rollout: - name: Verify - Production Rollout - needs: deploy - runs-on: ubuntu-latest - if: github.event_name == 'push' && github.ref == 'refs/heads/next' - steps: - - name: Await production rollout - run: | - TARGET_COMMIT="sha-$(echo ${{ github.sha }} | cut -c1-7)" - ENDPOINT="https://docs.ermnvldmr.com/version.json" - - echo "========================================================" - echo "Verifying production deployment on $ENDPOINT" - echo "Expected commit: $TARGET_COMMIT" - echo "========================================================" - - MAX_ATTEMPTS=45 - ATTEMPT=1 - CF_BLOCKED_COUNT=0 - - while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do - echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..." - - RESP_FILE=$(mktemp) - HTTP_CODE=$(curl -sL --max-time 10 \ - -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \ - -H "Accept: application/json" \ - -o "$RESP_FILE" \ - -w "%{http_code}" \ - "$ENDPOINT" || echo "000") - - if [ "$HTTP_CODE" = "200" ]; then - LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true) - echo " Live commit: ${LIVE_COMMIT:-}" - - if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then - echo "✅ Success! Production docs has successfully rolled out $TARGET_COMMIT." - rm -f "$RESP_FILE" - exit 0 - fi - elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then - echo " HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP." - CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1)) - else - echo " HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out." - fi - - rm -f "$RESP_FILE" - - if [ $CF_BLOCKED_COUNT -ge 5 ]; then - echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)." - echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster." - echo "Skipping further external HTTP verification to avoid false negative." - exit 0 - fi - - ATTEMPT=$((ATTEMPT + 1)) - sleep 10 - done - - echo "❌ Deployment verification timed out after 7.5 minutes." - exit 1 diff --git a/.github/workflows/services-docs-pr-required.yml b/.github/workflows/services-docs-pr-required.yml deleted file mode 100644 index 8dff36b..0000000 --- a/.github/workflows/services-docs-pr-required.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: services/docs - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'services/docs/**' - - '.github/workflows/services-docs-pr-required.yml' - -concurrency: - group: ci-pr-docs-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-hugo: - name: Setup - Hugo - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - fetch-depth: 0 - - - name: Setup Hugo - uses: peaceiris/actions-hugo@v2 - with: - hugo-version: 'latest' - extended: true - - build-hugo: - name: Build - Hugo Site - needs: setup-hugo - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: recursive - fetch-depth: 0 - - - name: Setup Hugo - uses: peaceiris/actions-hugo@v2 - with: - hugo-version: 'latest' - extended: true - - - name: Build Hugo site - working-directory: services/docs - run: hugo --gc --minify diff --git a/.github/workflows/services-static-next-required.yml b/.github/workflows/services-static-next-required.yml deleted file mode 100644 index 0f4410c..0000000 --- a/.github/workflows/services-static-next-required.yml +++ /dev/null @@ -1,205 +0,0 @@ -name: services/static - next/required - -on: - push: - branches: [next] - paths: - - 'services/static/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/services-static-next-required.yml' - - 'ci/scripts/**' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-static-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - retention-days: 1 - - lint-static: - name: Lint - Static - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Lint static service - run: pnpm --filter @ermnvldmr/static lint - - typecheck-static: - name: Typecheck - Static - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Typecheck static service - run: pnpm --filter @ermnvldmr/static typecheck - - build-static: - name: Build - Static Site - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Build static service - run: pnpm --filter @ermnvldmr/static build - - name: Upload build artifacts - uses: actions/upload-artifact@v4 - with: - name: static-dist - path: services/static/dist/ - retention-days: 1 - - deploy-s3: - name: Deploy - S3 - needs: [lint-static, typecheck-static, build-static] - runs-on: ubuntu-latest - if: github.event_name == 'push' && github.ref == 'refs/heads/next' - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Download build artifacts - uses: actions/download-artifact@v4 - with: - name: static-dist - path: services/static/dist/ - - - name: Deploy to S3 - env: - AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }} - AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }} - S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }} - AWS_REGION: ${{ secrets.STATIC_AWS_REGION }} - S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }} - run: | - chmod +x ci/scripts/deploy-static.sh - ./ci/scripts/deploy-static.sh diff --git a/.github/workflows/services-static-pr-required.yml b/.github/workflows/services-static-pr-required.yml deleted file mode 100644 index bf557ef..0000000 --- a/.github/workflows/services-static-pr-required.yml +++ /dev/null @@ -1,178 +0,0 @@ -name: services/static - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'services/static/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/services-static-pr-required.yml' - - 'ci/scripts/**' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-static-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build i18n - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload Config Artifacts - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - retention-days: 1 - - lint-static: - name: Lint - Static - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Lint static service - run: pnpm --filter @ermnvldmr/static lint - - typecheck-static: - name: Typecheck - Static - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Typecheck static service - run: pnpm --filter @ermnvldmr/static typecheck - - build-static: - name: Build - Static Site - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Config Artifacts - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Build static service - run: pnpm --filter @ermnvldmr/static build - - name: Upload build artifacts - uses: actions/upload-artifact@v4 - with: - name: static-dist-${{ github.run_id }} - path: services/static/dist/ - retention-days: 1 diff --git a/.github/workflows/services-www-next-required.yml b/.github/workflows/services-www-next-required.yml deleted file mode 100644 index 5eeebc9..0000000 --- a/.github/workflows/services-www-next-required.yml +++ /dev/null @@ -1,508 +0,0 @@ -name: services/www - next/required - -on: - push: - branches: [next] - paths: - - 'services/www/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/services-www-next-required.yml' - - 'ci/docker/www/**' - - 'ci/config/nginx/**' - - 'ci/scripts/**' - - 'pnpm-lock.yaml' - workflow_dispatch: - -concurrency: - group: ci-www-${{ github.ref_name }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - retention-days: 1 - - name: Build i18n package - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - retention-days: 1 - - lint-www: - name: Lint - WWW - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Lint WWW service - run: pnpm --filter @ermnvldmr/www lint - - typecheck-www: - name: Typecheck - WWW - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Typecheck WWW service - run: pnpm --filter @ermnvldmr/www typecheck - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Build WWW Storybook - run: pnpm --filter @ermnvldmr/www build-storybook - - name: Upload Storybook build - uses: actions/upload-artifact@v4 - with: - name: storybook-static - path: services/www/storybook-static/ - retention-days: 1 - - test-www: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Test WWW service - run: pnpm --filter @ermnvldmr/www test:coverage - - name: Upload Unit coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./services/www/coverage/lcov.info - flags: www - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium - - name: Download Storybook build - uses: actions/download-artifact@v4 - with: - name: storybook-static - path: services/www/storybook-static/ - - name: Serve Storybook and run tests with coverage - run: pnpm --filter @ermnvldmr/www test:storybook:ci - - name: Upload Storybook coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./services/www/coverage/storybook/lcov.info - flags: www-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-www: - name: Build - WWW Service - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist - path: packages/storybook-config/dist - - name: Build WWW service (all locales) - run: pnpm --filter @ermnvldmr/www build:all - env: - RSDOCTOR: 'true' - - name: Upload Rsdoctor report - uses: actions/upload-artifact@v4 - with: - name: rsdoctor-report - path: services/www/rsdoctor/ - retention-days: 30 - - build-docker: - name: Build - Docker Image - needs: [lint-www, typecheck-www, test-www, test-storybook, build-www] - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - outputs: - short_sha: ${{ steps.vars.outputs.short_sha }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Calculate Short SHA - id: vars - run: | - SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)" - echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Build and push Docker image - uses: docker/build-push-action@v5 - with: - context: . - file: ci/docker/www/Dockerfile - push: true - tags: ghcr.io/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha }} - build-args: | - COMMIT_SHA=${{ steps.vars.outputs.short_sha }} - VERSION=${{ steps.vars.outputs.short_sha }} - - release-tag-docker: - name: Release - Tag & Docker - needs: build-docker - runs-on: ubuntu-latest - environment: services-www-releases-publish - permissions: - contents: write - packages: write - outputs: - version: ${{ steps.calver.outputs.version }} - short_sha: ${{ needs.build-docker.outputs.short_sha }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Calculate CalVer Version - id: calver - run: | - VERSION=$(bash ci/scripts/calver-release.sh) - echo "version=$VERSION" >> $GITHUB_OUTPUT - - - name: Create and Push Tag - run: | - TAG_NAME="${{ steps.calver.outputs.version }}" - git tag "$TAG_NAME" - git push origin "$TAG_NAME" - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Tag and Push Release Docker Image - run: | - docker buildx imagetools create \ - ghcr.io/${{ github.repository }}/www:${{ needs.build-docker.outputs.short_sha }} \ - --tag ghcr.io/${{ github.repository }}/www:${{ steps.calver.outputs.version }} - - deploy: - name: Deploy - Kubernetes (GitOps) - needs: release-tag-docker - runs-on: ubuntu-latest - environment: - name: services-www-releases-deploy - url: https://ermnvldmr.com - permissions: - contents: write - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - ref: next - token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }} - - - name: Setup Kustomize - uses: imranismail/setup-kustomize@v2 - with: - kustomize-version: "5.3.0" - - - name: Deploy via GitOps - run: | - WWW_TAG="${{ needs.release-tag-docker.outputs.short_sha }}" - bash ci/scripts/deploy-gitops.sh www "${WWW_TAG}" - - verify-rollout: - name: Verify - Production Rollout - needs: [release-tag-docker, deploy] - runs-on: ubuntu-latest - steps: - - name: Await production rollout - run: | - TARGET_COMMIT="${{ needs.release-tag-docker.outputs.short_sha }}" - ENDPOINT="https://www.ermnvldmr.com/version.json" - - echo "========================================================" - echo "Verifying production deployment on $ENDPOINT" - echo "Expected commit: $TARGET_COMMIT" - echo "========================================================" - - MAX_ATTEMPTS=45 - ATTEMPT=1 - CF_BLOCKED_COUNT=0 - - while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do - echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..." - - RESP_FILE=$(mktemp) - HTTP_CODE=$(curl -sL --max-time 10 \ - -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \ - -H "Accept: application/json" \ - -o "$RESP_FILE" \ - -w "%{http_code}" \ - "$ENDPOINT" || echo "000") - - if [ "$HTTP_CODE" = "200" ]; then - LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true) - echo " Live commit: ${LIVE_COMMIT:-}" - - if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then - echo "✅ Success! Production has successfully rolled out $TARGET_COMMIT." - rm -f "$RESP_FILE" - exit 0 - fi - elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then - echo " HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP." - CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1)) - else - echo " HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out." - fi - - rm -f "$RESP_FILE" - - if [ $CF_BLOCKED_COUNT -ge 5 ]; then - echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)." - echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster." - echo "Skipping further external HTTP verification to avoid false negative." - exit 0 - fi - - ATTEMPT=$((ATTEMPT + 1)) - sleep 10 - done - - echo "❌ Deployment verification timed out after 7.5 minutes." - exit 1 diff --git a/.github/workflows/services-www-pr-required.yml b/.github/workflows/services-www-pr-required.yml deleted file mode 100644 index 1504f74..0000000 --- a/.github/workflows/services-www-pr-required.yml +++ /dev/null @@ -1,331 +0,0 @@ -name: services/www - pr/required - -on: - pull_request: - branches: [next] - paths: - - 'services/www/**' - - 'packages/ui/**' - - 'packages/stl/**' - - 'packages/i18n/**' - - '.github/workflows/services-www-pr-required.yml' - - 'pnpm-lock.yaml' - -concurrency: - group: ci-pr-www-${{ github.head_ref }} - cancel-in-progress: true - -permissions: - contents: read - actions: read - -jobs: - setup-stage: - name: Setup - Stage - runs-on: ubuntu-latest - outputs: - cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }} - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - - name: Setup Node.js with pnpm cache - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - - name: Cache pnpm store - id: cache-pnpm-store - uses: actions/cache@v3 - with: - path: ~/.pnpm-store - key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - build-configs: - name: Build - Configs - needs: setup-stage - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Build Rsbuild config - run: pnpm --filter @ermnvldmr/rsbuild-config build - - name: Build Storybook config - run: pnpm --filter @ermnvldmr/storybook-config build - - name: Upload Rsbuild Config - uses: actions/upload-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - retention-days: 1 - - name: Upload Storybook Config - uses: actions/upload-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - retention-days: 1 - - name: Build i18n package - run: pnpm --filter @ermnvldmr/i18n build - - name: Upload i18n dist - uses: actions/upload-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - retention-days: 1 - - lint-www: - name: Lint - WWW - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Lint WWW service - run: pnpm --filter @ermnvldmr/www lint - - typecheck-www: - name: Typecheck - WWW - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Typecheck WWW service - run: pnpm --filter @ermnvldmr/www typecheck - - build-storybook: - name: Build - Storybook - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Build WWW Storybook - run: pnpm --filter @ermnvldmr/www build-storybook - - name: Upload Storybook build - uses: actions/upload-artifact@v4 - with: - name: www-storybook-static-${{ github.run_id }} - path: services/www/storybook-static/ - retention-days: 1 - - test-www: - name: Test - Unit - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Test WWW service - run: pnpm --filter @ermnvldmr/www test:coverage - - name: Upload Unit coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./services/www/coverage/lcov.info - flags: www - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - test-storybook: - name: Test - Storybook - needs: build-storybook - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Install Playwright browsers - run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium - - name: Download Storybook build - uses: actions/download-artifact@v4 - with: - name: www-storybook-static-${{ github.run_id }} - path: services/www/storybook-static/ - - name: Serve Storybook and run tests with coverage - run: pnpm --filter @ermnvldmr/www test:storybook:ci - - name: Upload Storybook coverage to Codecov - uses: codecov/codecov-action@v4 - with: - files: ./services/www/coverage/storybook/lcov.info - flags: www-storybook - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - build-www: - name: Build - WWW Service - needs: build-configs - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 9.12.3 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: 'pnpm' - - name: Install dependencies - run: pnpm install --frozen-lockfile - - name: Download Rsbuild Config - uses: actions/download-artifact@v4 - with: - name: rsbuild-config-dist-${{ github.run_id }} - path: packages/rsbuild-config/dist - - name: Download i18n dist - uses: actions/download-artifact@v4 - with: - name: i18n-dist-${{ github.run_id }} - path: packages/i18n/dist - - name: Download Storybook Config - uses: actions/download-artifact@v4 - with: - name: storybook-config-dist-${{ github.run_id }} - path: packages/storybook-config/dist - - name: Build WWW service (all locales) - run: pnpm --filter @ermnvldmr/www build:all - env: - RSDOCTOR: 'true' - - name: Upload Rsdoctor report - uses: actions/upload-artifact@v4 - with: - name: rsdoctor-report-${{ github.run_id }} - path: services/www/rsdoctor/ - retention-days: 7 diff --git a/README.md b/README.md index d3de1ba..1346623 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,5 @@ # [ermnvldmr.com](https://ermnvldmr.com) -[![codecov](https://codecov.io/gh/deytenit/ermnvldmr.com/graph/badge.svg)](https://app.codecov.io/github/deytenit/ermnvldmr.com) The monorepo powering the front pages of my own @@ -58,7 +57,7 @@ Want to contribute or understand the codebase. - UI Library: `pnpm ui:dev` - **Development Guide**: [AGENTS.md](./AGENTS.md) - **Component Development**: `pnpm ui:storybook` -- **Testing**: `pnpm test` or `pnpm test:coverage` (View results on [Codecov](https://app.codecov.io/github/deytenit/ermnvldmr.com)) +- **Testing**: `pnpm test` or `pnpm test:coverage` - **Code Quality**: `pnpm lint` and `pnpm typecheck` ### Designer diff --git a/ci/k8s/apps/docs/deployment.yaml b/ci/k8s/apps/docs/deployment.yaml index 0472222..3a53ce7 100644 --- a/ci/k8s/apps/docs/deployment.yaml +++ b/ci/k8s/apps/docs/deployment.yaml @@ -20,7 +20,7 @@ spec: spec: containers: - name: docs - image: ghcr.io/deytenit/ermnvldmr.com/docs:sha-91f5245 + image: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs:sha-91f5245 imagePullPolicy: IfNotPresent ports: - name: http diff --git a/ci/k8s/apps/docs/kustomization.yaml b/ci/k8s/apps/docs/kustomization.yaml index 2429a39..e26e81a 100644 --- a/ci/k8s/apps/docs/kustomization.yaml +++ b/ci/k8s/apps/docs/kustomization.yaml @@ -5,5 +5,5 @@ resources: - deployment.yaml - service.yaml images: -- name: ghcr.io/deytenit/ermnvldmr.com/docs +- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/docs newTag: sha-84772ff diff --git a/ci/k8s/apps/www/deployment.yaml b/ci/k8s/apps/www/deployment.yaml index 6de6f4a..44e4012 100644 --- a/ci/k8s/apps/www/deployment.yaml +++ b/ci/k8s/apps/www/deployment.yaml @@ -20,7 +20,7 @@ spec: spec: containers: - name: www - image: ghcr.io/deytenit/ermnvldmr.com/www:sha-6d33b71 + image: git.ermnvldmr.com/deytenit/ermnvldmr.com/www:sha-6d33b71 imagePullPolicy: IfNotPresent ports: - name: http diff --git a/ci/k8s/apps/www/kustomization.yaml b/ci/k8s/apps/www/kustomization.yaml index 8da0efb..11959d9 100644 --- a/ci/k8s/apps/www/kustomization.yaml +++ b/ci/k8s/apps/www/kustomization.yaml @@ -5,5 +5,5 @@ resources: - deployment.yaml - service.yaml images: -- name: ghcr.io/deytenit/ermnvldmr.com/www - newTag: sha-84772ff +- name: git.ermnvldmr.com/deytenit/ermnvldmr.com/www + newTag: sha-fea1928 diff --git a/ci/k8s/clusters/production/flux-system/gotk-sync.yaml b/ci/k8s/clusters/production/flux-system/gotk-sync.yaml index 78d80d6..cebe9c4 100644 --- a/ci/k8s/clusters/production/flux-system/gotk-sync.yaml +++ b/ci/k8s/clusters/production/flux-system/gotk-sync.yaml @@ -5,7 +5,7 @@ metadata: namespace: flux-system spec: interval: 1m - url: https://github.com/deytenit/ermnvldmr.com.git + url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git ref: branch: next --- diff --git a/ci/k8s/infrastructure/cert-manager/install.yaml b/ci/k8s/infrastructure/cert-manager/install.yaml new file mode 100644 index 0000000..45752d2 --- /dev/null +++ b/ci/k8s/infrastructure/cert-manager/install.yaml @@ -0,0 +1,13286 @@ +# Copyright 2022 The cert-manager Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: cert-manager + +--- +# Source: cert-manager/templates/crds.yaml +# +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificaterequests.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: cert-manager.io + names: + kind: CertificateRequest + listKind: CertificateRequestList + plural: certificaterequests + shortNames: + - cr + - crs + singular: certificaterequest + categories: + - cert-manager + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requester + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: |- + A CertificateRequest is used to request a signed certificate from one of the + configured issuers. + + All fields within the CertificateRequest's `spec` are immutable after creation. + A CertificateRequest will either succeed or fail, as denoted by its `Ready` status + condition and its `status.failureTime` field. + + A CertificateRequest is a one-shot resource, meaning it represents a single + point in time request for a certificate and cannot be re-used. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the CertificateRequest resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - issuerRef + - request + properties: + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + type: string + extra: + description: |- + Extra contains extra attributes of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: |- + Groups contains group membership of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. Note that the issuer may choose + to ignore the requested isCA value, just like any other requested attribute. + + NOTE: If the CSR in the `Request` field has a BasicConstraints extension, + it must have the same isCA value as specified here. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: |- + The PEM-encoded X.509 certificate signing request to be submitted to the + issuer for signing. + + If the CSR has a BasicConstraints extension, its isCA attribute must + match the `isCA` value of this CertificateRequest. + If the CSR has a KeyUsage extension, its key usages must match the + key usages in the `usages` field of this CertificateRequest. + If the CSR has a ExtKeyUsage extension, its extended key usages + must match the extended key usages in the `usages` field of this + CertificateRequest. + type: string + format: byte + uid: + description: |- + UID contains the uid of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: |- + Requested key usages and extended key usages. + + NOTE: If the CSR in the `Request` field has uses the KeyUsage or + ExtKeyUsage extension, these extensions must have the same values + as specified here without any additional values. + + If unset, defaults to `digital signature` and `key encipherment`. + type: array + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: |- + Username contains the name of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: |- + Status of the CertificateRequest. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + ca: + description: |- + The PEM encoded X.509 certificate of the signer, also known as the CA + (Certificate Authority). + This is set on a best-effort basis by different issuers. + If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: |- + The PEM encoded X.509 certificate resulting from the certificate + signing request. + If not set, the CertificateRequest has either not been completed or has + failed. More information on failure can be found by checking the + `conditions` field. + type: string + format: byte + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: |- + Type of the condition, known values are (`Ready`, `InvalidRequest`, + `Approved`, `Denied`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failureTime: + description: |- + FailureTime stores the time that this CertificateRequest failed. This is + used to influence garbage collection and back-off. + type: string + format: date-time + served: true + storage: true + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: cert-manager.io + names: + kind: Certificate + listKind: CertificateList + plural: certificates + shortNames: + - cert + - certs + singular: certificate + categories: + - cert-manager + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: |- + A Certificate resource should be created to ensure an up to date and signed + X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. + + The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the Certificate resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - issuerRef + - secretName + properties: + additionalOutputFormats: + description: |- + Defines extra output formats of the private key and signed certificate chain + to be written to this Certificate's target Secret. + + This is a Beta Feature enabled by default. It can be disabled with the + `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both + the controller and webhook components. + type: array + items: + description: |- + CertificateAdditionalOutputFormat defines an additional output format of a + Certificate resource. These contain supplementary data formats of the signed + certificate chain and paired private key. + type: object + required: + - type + properties: + type: + description: |- + Type is the name of the format type that should be written to the + Certificate's target Secret. + type: string + enum: + - DER + - CombinedPEM + commonName: + description: |- + Requested common name X509 certificate subject attribute. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + NOTE: TLS clients will ignore this value when any subject alternative name is + set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). + + Should have a length of 64 characters or fewer to avoid generating invalid CSRs. + Cannot be set if the `literalSubject` field is set. + type: string + dnsNames: + description: Requested DNS subject alternative names. + type: array + items: + type: string + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + + If unset, this defaults to 90 days. + Minimum accepted duration is 1 hour. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + type: string + emailAddresses: + description: Requested email subject alternative names. + type: array + items: + type: string + encodeUsagesInRequest: + description: |- + Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. + + This option defaults to true, and should only be disabled if the target + issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. + type: boolean + ipAddresses: + description: Requested IP address subject alternative names. + type: array + items: + type: string + isCA: + description: |- + Requested basic constraints isCA value. + The isCA value is used to set the `isCA` field on the created CertificateRequest + resources. Note that the issuer may choose to ignore the requested isCA value, just + like any other requested attribute. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keystores: + description: Additional keystore output formats to be stored in the Certificate's Secret. + type: object + properties: + jks: + description: |- + JKS configures options for storing a JKS keystore in the + `spec.secretName` Secret resource. + type: object + required: + - create + properties: + alias: + description: |- + Alias specifies the alias of the key in the keystore, required by the JKS format. + If not provided, the default alias `certificate` will be used. + type: string + create: + description: |- + Create enables JKS keystore creation for the Certificate. + If true, a file named `keystore.jks` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.jks` + will also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` + containing the issuing Certificate Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the JKS keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the JKS keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + pkcs12: + description: |- + PKCS12 configures options for storing a PKCS12 keystore in the + `spec.secretName` Secret resource. + type: object + required: + - create + properties: + create: + description: |- + Create enables PKCS12 keystore creation for the Certificate. + If true, a file named `keystore.p12` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or in `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.p12` will + also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` containing the issuing Certificate + Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the PKCS#12 keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the PKCS#12 keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + profile: + description: |- + Profile specifies the key and certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms + (eg. because of company policy). Please note that the security of the algorithm is not that important + in reality, because the unencrypted certificate and private key are also stored in the Secret. + type: string + enum: + - LegacyRC2 + - LegacyDES + - Modern2023 + literalSubject: + description: |- + Requested X.509 certificate subject, represented using the LDAP "String + Representation of a Distinguished Name" [1]. + Important: the LDAP string format also specifies the order of the attributes + in the subject, this is important when issuing certs for LDAP authentication. + Example: `CN=foo,DC=corp,DC=example,DC=com` + More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 + More info: https://github.com/cert-manager/cert-manager/issues/3203 + More info: https://github.com/cert-manager/cert-manager/issues/4424 + + Cannot be set if the `subject` or `commonName` field is set. + type: string + nameConstraints: + description: |- + x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. + More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + + This is an Alpha Feature and is only enabled with the + `--feature-gates=NameConstraints=true` option set on both + the controller and webhook components. + type: object + properties: + critical: + description: if true then the name constraints are marked critical. + type: boolean + excluded: + description: |- + Excluded contains the constraints which must be disallowed. Any name matching a + restriction in the excluded field is invalid regardless + of information appearing in the permitted + type: object + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + type: array + items: + type: string + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + type: array + items: + type: string + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + type: array + items: + type: string + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + type: array + items: + type: string + permitted: + description: Permitted contains the constraints in which the names must be located. + type: object + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + type: array + items: + type: string + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + type: array + items: + type: string + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + type: array + items: + type: string + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + type: array + items: + type: string + otherNames: + description: |- + `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 + Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. + Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 + You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. + type: array + items: + type: object + properties: + oid: + description: |- + OID is the object identifier for the otherName SAN. + The object identifier must be expressed as a dotted string, for + example, "1.2.840.113556.1.4.221". + type: string + utf8Value: + description: |- + utf8Value is the string value of the otherName SAN. + The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. + type: string + privateKey: + description: |- + Private key options. These include the key algorithm and size, the used + encoding and the rotation policy. + type: object + properties: + algorithm: + description: |- + Algorithm is the private key algorithm of the corresponding private key + for this certificate. + + If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. + If `algorithm` is specified and `size` is not provided, + key size of 2048 will be used for `RSA` key algorithm and + key size of 256 will be used for `ECDSA` key algorithm. + key size is ignored when using the `Ed25519` key algorithm. + type: string + enum: + - RSA + - ECDSA + - Ed25519 + encoding: + description: |- + The private key cryptography standards (PKCS) encoding for this + certificate's private key to be encoded in. + + If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 + and PKCS#8, respectively. + Defaults to `PKCS1` if not specified. + type: string + enum: + - PKCS1 + - PKCS8 + rotationPolicy: + description: |- + RotationPolicy controls how private keys should be regenerated when a + re-issuance is being processed. + + If set to `Never`, a private key will only be generated if one does not + already exist in the target `spec.secretName`. If one does exist but it + does not have the correct algorithm or size, a warning will be raised + to await user intervention. + If set to `Always`, a private key matching the specified requirements + will be generated whenever a re-issuance occurs. + Default is `Never` for backward compatibility. + type: string + enum: + - Never + - Always + size: + description: |- + Size is the key bit size of the corresponding private key for this certificate. + + If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, + and will default to `2048` if not specified. + If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, + and will default to `256` if not specified. + If `algorithm` is set to `Ed25519`, Size is ignored. + No other values are allowed. + type: integer + renewBefore: + description: |- + How long before the currently issued certificate's expiry cert-manager should + renew the certificate. For example, if a certificate is valid for 60 minutes, + and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate + 50 minutes after it was issued (i.e. when there are 10 minutes remaining until + the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + If unset, this defaults to 1/3 of the issued certificate's lifetime. + Minimum accepted value is 5 minutes. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + Cannot be set if the `renewBeforePercentage` field is set. + type: string + renewBeforePercentage: + description: |- + `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage + rather than an absolute duration. For example, if a certificate is valid for 60 + minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to + renew the certificate 45 minutes after it was issued (i.e. when there are 15 + minutes (25%) remaining until the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + Value must be an integer in the range (0,100). The minimum effective + `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 + minutes. + Cannot be set if the `renewBefore` field is set. + type: integer + format: int32 + revisionHistoryLimit: + description: |- + The maximum number of CertificateRequest revisions that are maintained in + the Certificate's history. Each revision represents a single `CertificateRequest` + created by this Certificate, either when it was created, renewed, or Spec + was changed. Revisions will be removed by oldest first if the number of + revisions exceeds this number. + + If set, revisionHistoryLimit must be a value of `1` or greater. + If unset (`nil`), revisions will not be garbage collected. + Default value is `nil`. + type: integer + format: int32 + secretName: + description: |- + Name of the Secret resource that will be automatically created and + managed by this Certificate resource. It will be populated with a + private key and certificate, signed by the denoted issuer. The Secret + resource lives in the same namespace as the Certificate resource. + type: string + secretTemplate: + description: |- + Defines annotations and labels to be copied to the Certificate's Secret. + Labels and annotations on the Secret will be changed as they appear on the + SecretTemplate when added or removed. SecretTemplate annotations are added + in conjunction with, and cannot overwrite, the base set of annotations + cert-manager sets on the Certificate's Secret. + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: |- + Requested set of X509 certificate subject attributes. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + + The common name attribute is specified separately in the `commonName` field. + Cannot be set if the `literalSubject` field is set. + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + organizations: + description: Organizations to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uris: + description: Requested URI subject alternative names. + type: array + items: + type: string + usages: + description: |- + Requested key usages and extended key usages. + These usages are used to set the `usages` field on the created CertificateRequest + resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages + will additionally be encoded in the `request` field which contains the CSR blob. + + If unset, defaults to `digital signature` and `key encipherment`. + type: array + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + status: + description: |- + Status of the Certificate. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + conditions: + description: |- + List of status conditions to indicate the status of certificates. + Known condition types are `Ready` and `Issuing`. + type: array + items: + description: CertificateCondition contains condition information for a Certificate. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Certificate. + type: integer + format: int64 + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failedIssuanceAttempts: + description: |- + The number of continuous failed issuance attempts up till now. This + field gets removed (if set) on a successful issuance and gets set to + 1 if unset and an issuance has failed. If an issuance has failed, the + delay till the next issuance will be calculated using formula + time.Hour * 2 ^ (failedIssuanceAttempts - 1). + type: integer + lastFailureTime: + description: |- + LastFailureTime is set only if the latest issuance for this + Certificate failed and contains the time of the failure. If an + issuance has failed, the delay till the next issuance will be + calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - + 1). If the latest issuance has succeeded this field will be unset. + type: string + format: date-time + nextPrivateKeySecretName: + description: |- + The name of the Secret resource containing the private key to be used + for the next certificate iteration. + The keymanager controller will automatically set this field if the + `Issuing` condition is set to `True`. + It will automatically unset this field when the Issuing condition is + not set or False. + type: string + notAfter: + description: |- + The expiration time of the certificate stored in the secret named + by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: + description: |- + The time after which the certificate stored in the secret named + by this resource in `spec.secretName` is valid. + type: string + format: date-time + renewalTime: + description: |- + RenewalTime is the time at which the certificate will be next + renewed. + If not set, no upcoming renewal is scheduled. + type: string + format: date-time + revision: + description: |- + The current 'revision' of the certificate as issued. + + When a CertificateRequest resource is created, it will have the + `cert-manager.io/certificate-revision` set to one greater than the + current value of this field. + + Upon issuance, this field will be set to the value of the annotation + on the CertificateRequest resource used to issue the certificate. + + Persisting the value on the CertificateRequest resource allows the + certificates controller to know whether a request is part of an old + issuance or if it is part of the ongoing revision's issuance by + checking if the revision value in the annotation is greater than this + field. + type: integer + served: true + storage: true + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: challenges.acme.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: acme.cert-manager.io + names: + kind: Challenge + listKind: ChallengeList + plural: challenges + singular: challenge + categories: + - cert-manager + - cert-manager-acme + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + type: object + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + properties: + authorizationURL: + description: |- + The URL to the ACME Authorization resource that this + challenge is a part of. + type: string + dnsName: + description: |- + dnsName is the identifier that this challenge is for, e.g. example.com. + If the requested DNSName is a 'wildcard', this field MUST be set to the + non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: |- + References a properly configured ACME-type Issuer which should + be used to create this Challenge. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Challenge will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + key: + description: |- + The ACME challenge key for this challenge + For HTTP01 challenges, this is the value that must be responded with to + complete the HTTP01 challenge in the format: + `.`. + For DNS01 challenges, this is the base64 encoded SHA256 sum of the + `.` + text that must be set as the TXT record content. + type: string + solver: + description: |- + Contains the domain solving configuration that should be used to + solve this challenge resource. + type: object + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + additionalProperties: + type: string + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + type: object + required: + - name + properties: + group: + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + type: string + default: gateway.networking.k8s.io + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + kind: + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + type: string + default: Gateway + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + name: + description: |- + Name is the name of the referent. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + type: string + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + type: integer + format: int32 + maximum: 65535 + minimum: 1 + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + type: object + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + matchLabels: + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + additionalProperties: + type: string + token: + description: |- + The ACME challenge token for this challenge. + This is the raw value returned from the ACME server. + type: string + type: + description: |- + The type of ACME challenge this resource represents. + One of "HTTP-01" or "DNS-01". + type: string + enum: + - HTTP-01 + - DNS-01 + url: + description: |- + The URL of the ACME Challenge resource for this challenge. + This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: |- + wildcard will be true if this challenge is for a wildcard identifier, + for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: + description: |- + presented will be set to true if the challenge values for this challenge + are currently 'presented'. + This *does not* imply the self check is passing. Only that the values + have been 'submitted' for the appropriate challenge mechanism (i.e. the + DNS01 TXT record has been presented, or the HTTP01 configuration has been + configured). + type: boolean + processing: + description: |- + Used to denote whether this challenge should be processed or not. + This field will only be set to true by the 'scheduling' component. + It will only be set to false by the 'challenges' controller, after the + challenge has reached a final state or timed out. + If this field is set to false, the challenge controller will not take + any more action. + type: boolean + reason: + description: |- + Contains human readable information on why the Challenge is in the + current state. + type: string + state: + description: |- + Contains the current 'state' of the challenge. + If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + served: true + storage: true + subresources: + status: {} + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterissuers.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: cert-manager.io + names: + kind: ClusterIssuer + listKind: ClusterIssuerList + plural: clusterissuers + singular: clusterissuer + categories: + - cert-manager + scope: Cluster + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: |- + A ClusterIssuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is similar to an Issuer, however it is cluster-scoped and therefore can + be referenced by resources that exist in *any* namespace, not just the same + namespace as the referent. + type: object + required: + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + type: object + properties: + acme: + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + type: string + format: byte + disableAccountKeyGeneration: + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. + type: boolean + email: + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. + type: boolean + externalAccountBinding: + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + preferredChain: + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST crosssign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. + type: string + maxLength: 64 + privateKeySecretRef: + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + server: + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. + type: string + skipTLSVerify: + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. + type: boolean + solvers: + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ + type: array + items: + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. + type: object + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + additionalProperties: + type: string + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + type: object + required: + - name + properties: + group: + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + type: string + default: gateway.networking.k8s.io + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + kind: + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + type: string + default: Gateway + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + name: + description: |- + Name is the name of the referent. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + type: string + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + type: integer + format: int32 + maximum: 65535 + minimum: 1 + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + type: object + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + matchLabels: + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + issuingCertificateURLs: + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". + type: array + items: + type: string + ocspServers: + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. + type: string + selfSigned: + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" + type: string + roleId: + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. + type: string + secretRef: + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertificate: + description: |- + ClientCertificate authenticates with Vault by presenting a client + certificate during the request's TLS handshake. + Works only when using HTTPS protocol. + type: object + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/cert" will be used. + type: string + name: + description: |- + Name of the certificate role to authenticate against. + If not set, matching any certificate role, if available. + type: string + secretName: + description: |- + Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing + tls.crt and tls.key) used to authenticate to Vault using TLS client + authentication. + type: string + kubernetes: + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. + type: object + required: + - role + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + type: string + format: byte + caBundleSecretRef: + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + type: string + path: + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: |- + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: |- + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + url: + description: |- + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: |- + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. + type: string + format: byte + caBundleSecretRef: + description: |- + Reference to a Secret containing a base64-encoded bundle of PEM CAs + which will be used to validate the certificate chain presented by the TPP server. + Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + credentialsRef: + description: |- + CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + The secret must contain the key 'access-token' for the Access Token Authentication, + or two keys, 'username' and 'password' for the API Keys Authentication. + type: object + required: + - name + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + url: + description: |- + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + for example: "https://tpp.example.com/vedsdk". + type: string + zone: + description: |- + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named + zone policy. + This field is required. + type: string + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + type: object + properties: + acme: + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. + type: object + properties: + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA + type: string + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + served: true + storage: true + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: issuers.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + app.kubernetes.io/component: "crds" + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: cert-manager.io + names: + kind: Issuer + listKind: IssuerList + plural: issuers + singular: issuer + categories: + - cert-manager + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: |- + An Issuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is scoped to a single namespace and can therefore only be referenced by + resources within the same namespace. + type: object + required: + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + type: object + properties: + acme: + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + type: string + format: byte + disableAccountKeyGeneration: + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. + type: boolean + email: + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. + type: boolean + externalAccountBinding: + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef + properties: + keyAlgorithm: + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. + type: string + enum: + - HS256 + - HS384 + - HS512 + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + preferredChain: + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST crosssign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. + type: string + maxLength: 64 + privateKeySecretRef: + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + server: + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. + type: string + skipTLSVerify: + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. + type: boolean + solvers: + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ + type: array + items: + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. + type: object + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + type: object + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + type: string + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + type: object + required: + - nameserver + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + additionalProperties: + type: string + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + type: object + required: + - name + properties: + group: + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + type: string + default: gateway.networking.k8s.io + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + kind: + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + type: string + default: Gateway + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + name: + description: |- + Name is the name of the referent. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + type: string + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + type: integer + format: int32 + maximum: 65535 + minimum: 1 + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + type: object + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + matchLabels: + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + additionalProperties: + type: string + ca: + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. + type: array + items: + type: string + issuingCertificateURLs: + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". + type: array + items: + type: string + ocspServers: + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array + items: + type: string + secretName: + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. + type: string + selfSigned: + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. + type: object + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. + type: array + items: + type: string + vault: + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. + type: object + required: + - auth + - path + - server + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + type: object + properties: + appRole: + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef + properties: + path: + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" + type: string + roleId: + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. + type: string + secretRef: + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertificate: + description: |- + ClientCertificate authenticates with Vault by presenting a client + certificate during the request's TLS handshake. + Works only when using HTTPS protocol. + type: object + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/cert" will be used. + type: string + name: + description: |- + Name of the certificate role to authenticate against. + If not set, matching any certificate role, if available. + type: string + secretName: + description: |- + Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing + tls.crt and tls.key) used to authenticate to Vault using TLS client + authentication. + type: string + kubernetes: + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. + type: object + required: + - role + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + type: string + format: byte + caBundleSecretRef: + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + type: string + path: + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + venafi: + description: |- + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. + type: object + required: + - zone + properties: + cloud: + description: |- + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + url: + description: |- + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". + type: string + tpp: + description: |- + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - credentialsRef + - url + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. + type: string + format: byte + caBundleSecretRef: + description: |- + Reference to a Secret containing a base64-encoded bundle of PEM CAs + which will be used to validate the certificate chain presented by the TPP server. + Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + credentialsRef: + description: |- + CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + The secret must contain the key 'access-token' for the Access Token Authentication, + or two keys, 'username' and 'password' for the API Keys Authentication. + type: object + required: + - name + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + url: + description: |- + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + for example: "https://tpp.example.com/vedsdk". + type: string + zone: + description: |- + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named + zone policy. + This field is required. + type: string + status: + description: Status of the Issuer. This is set and managed automatically. + type: object + properties: + acme: + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. + type: object + properties: + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA + type: string + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + served: true + storage: true + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: orders.acme.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + app.kubernetes.io/component: "crds" + # Generated labels + app.kubernetes.io/version: "v1.17.0" +spec: + group: acme.cert-manager.io + names: + kind: Order + listKind: OrderList + plural: orders + singular: order + categories: + - cert-manager + - cert-manager-acme + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + type: object + required: + - issuerRef + - request + properties: + commonName: + description: |- + CommonName is the common name as specified on the DER encoded CSR. + If specified, this value must also be present in `dnsNames` or `ipAddresses`. + This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: |- + DNSNames is a list of DNS names that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: |- + Duration is the duration for the not after date for the requested certificate. + this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: |- + IPAddresses is a list of IP addresses that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: |- + IssuerRef references a properly configured ACME-type Issuer which should + be used to create this Order. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Order will be marked as failed. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + request: + description: |- + Certificate signing request bytes in DER encoding. + This will be used when finalizing the order. + This field must be set on the order. + type: string + format: byte + status: + type: object + properties: + authorizations: + description: |- + Authorizations contains data returned from the ACME server on what + authorizations must be completed in order to validate the DNS names + specified on the Order. + type: array + items: + description: |- + ACMEAuthorization contains data returned from the ACME server on an + authorization that must be completed in order validate a DNS name on an ACME + Order resource. + type: object + required: + - url + properties: + challenges: + description: |- + Challenges specifies the challenge types offered by the ACME server. + One of these challenge types will be selected when validating the DNS + name and an appropriate Challenge resource will be created to perform + the ACME challenge process. + type: array + items: + description: |- + Challenge specifies a challenge offered by the ACME server for an Order. + An appropriate Challenge resource can be created to perform the ACME + challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: |- + Token is the token that must be presented for this challenge. + This is used to compute the 'key' that must also be presented. + type: string + type: + description: |- + Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', + 'tls-sni-01', etc. + This is the raw value retrieved from the ACME server. + Only 'http-01' and 'dns-01' are supported by cert-manager, other values + will be ignored. + type: string + url: + description: |- + URL is the URL of this challenge. It can be used to retrieve additional + metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: |- + InitialState is the initial state of the ACME authorization when first + fetched from the ACME server. + If an Authorization is already 'valid', the Order controller will not + create a Challenge resource for the authorization. This will occur when + working with an ACME server that enables 'authz reuse' (such as Let's + Encrypt's production endpoint). + If not set and 'identifier' is set, the state is assumed to be pending + and a Challenge will be created. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: |- + Wildcard will be true if this authorization is for a wildcard DNS name. + If this is true, the identifier will be the *non-wildcard* version of + the DNS name. + For example, if '*.example.com' is the DNS name being validated, this + field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: |- + Certificate is a copy of the PEM encoded certificate for this Order. + This field will be populated after the order has been successfully + finalized with the ACME server, and the order has transitioned to the + 'valid' state. + type: string + format: byte + failureTime: + description: |- + FailureTime stores the time that this order failed. + This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: |- + FinalizeURL of the Order. + This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: |- + Reason optionally provides more information about a why the order is in + the current state. + type: string + state: + description: |- + State contains the current state of this Order resource. + States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: |- + URL of the Order. + This will initially be empty when the resource is first created. + The Order controller will populate this field when the Order is first processed. + This field will be immutable after it is initially set. + type: string + served: true + storage: true + +# END crd + +--- +# Source: cert-manager/templates/cainjector-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +--- +# Source: cert-manager/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +--- +# Source: cert-manager/templates/webhook-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-cainjector + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["get", "create", "update", "patch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["apiregistration.k8s.io"] + resources: ["apiservices"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch", "update", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Issuer controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-issuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["issuers", "issuers/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# ClusterIssuer controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-clusterissuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers", "clusterissuers/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Certificates controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-certificates + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"] + verbs: ["get", "list", "watch"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["cert-manager.io"] + resources: ["certificates/finalizers", "certificaterequests/finalizers"] + verbs: ["update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders"] + verbs: ["create", "delete", "get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete", "patch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Orders controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-orders + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders", "orders/status"] + verbs: ["update", "patch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders", "challenges"] + verbs: ["get", "list", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers", "issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["create", "delete"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders/finalizers"] + verbs: ["update"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Challenges controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-challenges + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + # Use to update challenge resource status + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges", "challenges/status"] + verbs: ["update", "patch"] + # Used to watch challenge resources + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "watch"] + # Used to watch challenges, issuer and clusterissuer resources + - apiGroups: ["cert-manager.io"] + resources: ["issuers", "clusterissuers"] + verbs: ["get", "list", "watch"] + # Need to be able to retrieve ACME account private key to complete challenges + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + # Used to create events + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] + # HTTP01 rules + - apiGroups: [""] + resources: ["pods", "services"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "create", "delete", "update"] + - apiGroups: [ "gateway.networking.k8s.io" ] + resources: [ "httproutes" ] + verbs: ["get", "list", "watch", "create", "delete", "update"] + # We require the ability to specify a custom hostname when we are creating + # new ingress resources. + # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148 + - apiGroups: ["route.openshift.io"] + resources: ["routes/custom-host"] + verbs: ["create"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges/finalizers"] + verbs: ["update"] + # DNS01 rules (duplicated above) + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +# ingress-shim controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-ingress-shim + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests"] + verbs: ["create", "update", "delete"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses/finalizers"] + verbs: ["update"] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways", "httproutes"] + verbs: ["get", "list", "watch"] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways/finalizers", "httproutes/finalizers"] + verbs: ["update"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-cluster-view + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-view + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges", "orders"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-edit + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates/status"] + verbs: ["update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges", "orders"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] +--- +# Source: cert-manager/templates/rbac.yaml +# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-approve:cert-manager-io + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["signers"] + verbs: ["approve"] + resourceNames: + - "issuers.cert-manager.io/*" + - "clusterissuers.cert-manager.io/*" +--- +# Source: cert-manager/templates/rbac.yaml +# Permission to: +# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers +# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-certificatesigningrequests + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests/status"] + verbs: ["update", "patch"] + - apiGroups: ["certificates.k8s.io"] + resources: ["signers"] + resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] + verbs: ["sign"] + - apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-webhook:subjectaccessreviews + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +rules: +- apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-cainjector + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-cainjector +subjects: + - name: cert-manager-cainjector + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-issuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-issuers +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-clusterissuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-clusterissuers +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-certificates + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-certificates +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-orders + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-orders +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-challenges + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-challenges +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-ingress-shim + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-ingress-shim +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-approve:cert-manager-io + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-approve:cert-manager-io +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-certificatesigningrequests + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-certificatesigningrequests +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-webhook:subjectaccessreviews + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-webhook:subjectaccessreviews +subjects: +- kind: ServiceAccount + name: cert-manager-webhook + namespace: cert-manager +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +# leader election rules +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-cainjector:leaderelection + namespace: kube-system + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +rules: + # Used for leader election by the controller + # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller + # see cmd/cainjector/start.go#L113 + # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller + # see cmd/cainjector/start.go#L137 + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"] + verbs: ["get", "update", "patch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager:leaderelection + namespace: kube-system + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + resourceNames: ["cert-manager-controller"] + verbs: ["get", "update", "patch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-tokenrequest + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +rules: + - apiGroups: [""] + resources: ["serviceaccounts/token"] + resourceNames: ["cert-manager"] + verbs: ["create"] +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-webhook:dynamic-serving + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: + - 'cert-manager-webhook-ca' + verbs: ["get", "list", "watch", "update"] +# It's not possible to grant CREATE permission on a single resourceName. +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +# grant cert-manager permission to manage the leaderelection configmap in the +# leader election namespace +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-cainjector:leaderelection + namespace: kube-system + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-cainjector:leaderelection +subjects: + - kind: ServiceAccount + name: cert-manager-cainjector + namespace: cert-manager +--- +# Source: cert-manager/templates/rbac.yaml +# grant cert-manager permission to manage the leaderelection configmap in the +# leader election namespace +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager:leaderelection + namespace: kube-system + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager:leaderelection +subjects: + - kind: ServiceAccount + name: cert-manager + namespace: cert-manager +--- +# Source: cert-manager/templates/rbac.yaml +# grant cert-manager permission to create tokens for the serviceaccount +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-cert-manager-tokenrequest + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-tokenrequest +subjects: + - kind: ServiceAccount + name: cert-manager + namespace: cert-manager +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-webhook:dynamic-serving + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-webhook:dynamic-serving +subjects: +- kind: ServiceAccount + name: cert-manager-webhook + namespace: cert-manager +--- +# Source: cert-manager/templates/cainjector-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +spec: + type: ClusterIP + ports: + - protocol: TCP + port: 9402 + name: http-metrics + selector: + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" +--- +# Source: cert-manager/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +spec: + type: ClusterIP + ports: + - protocol: TCP + port: 9402 + name: tcp-prometheus-servicemonitor + targetPort: 9402 + selector: + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" +--- +# Source: cert-manager/templates/webhook-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +spec: + type: ClusterIP + ports: + - name: https + port: 443 + protocol: TCP + targetPort: "https" + - name: metrics + port: 9402 + protocol: TCP + targetPort: "http-metrics" + selector: + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" +--- +# Source: cert-manager/templates/cainjector-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + template: + metadata: + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.17.0" + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager-cainjector + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-cainjector + image: "quay.io/jetstack/cert-manager-cainjector:v1.17.0" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --leader-election-namespace=kube-system + ports: + - containerPort: 9402 + name: http-metrics + protocol: TCP + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + nodeSelector: + kubernetes.io/os: linux +--- +# Source: cert-manager/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + template: + metadata: + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-controller + image: "quay.io/jetstack/cert-manager-controller:v1.17.0" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --cluster-resource-namespace=$(POD_NAMESPACE) + - --leader-election-namespace=kube-system + - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.0 + - --max-concurrent-challenges=60 + ports: + - containerPort: 9402 + name: http-metrics + protocol: TCP + - containerPort: 9403 + name: http-healthz + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + # LivenessProbe settings are based on those used for the Kubernetes + # controller-manager. See: + # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 + livenessProbe: + httpGet: + port: http-healthz + path: /livez + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 8 + nodeSelector: + kubernetes.io/os: linux +--- +# Source: cert-manager/templates/webhook-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + template: + metadata: + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager-webhook + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-webhook + image: "quay.io/jetstack/cert-manager-webhook:v1.17.0" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --secure-port=10250 + - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) + - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca + - --dynamic-serving-dns-names=cert-manager-webhook + - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) + - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc + + ports: + - name: https + protocol: TCP + containerPort: 10250 + - name: healthcheck + protocol: TCP + containerPort: 6080 + - containerPort: 9402 + name: http-metrics + protocol: TCP + livenessProbe: + httpGet: + path: /livez + port: 6080 + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /healthz + port: 6080 + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + nodeSelector: + kubernetes.io/os: linux +--- +# Source: cert-manager/templates/crds.yaml +# +# START crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +--- +# Source: cert-manager/templates/webhook-mutating-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: cert-manager-webhook + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" +webhooks: + - name: webhook.cert-manager.io + rules: + - apiGroups: + - "cert-manager.io" + apiVersions: + - "v1" + operations: + - CREATE + resources: + - "certificaterequests" + admissionReviewVersions: ["v1"] + # This webhook only accepts v1 cert-manager resources. + # Equivalent matchPolicy ensures that non-v1 resource requests are sent to + # this webhook (after the resources have been converted to v1). + matchPolicy: Equivalent + timeoutSeconds: 30 + failurePolicy: Fail + # Only include 'sideEffects' field in Kubernetes 1.12+ + sideEffects: None + clientConfig: + service: + name: cert-manager-webhook + namespace: cert-manager + path: /mutate +--- +# Source: cert-manager/templates/webhook-validating-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: cert-manager-webhook + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.17.0" + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" +webhooks: + - name: webhook.cert-manager.io + namespaceSelector: + matchExpressions: + - key: cert-manager.io/disable-validation + operator: NotIn + values: + - "true" + rules: + - apiGroups: + - "cert-manager.io" + - "acme.cert-manager.io" + apiVersions: + - "v1" + operations: + - CREATE + - UPDATE + resources: + - "*/*" + admissionReviewVersions: ["v1"] + # This webhook only accepts v1 cert-manager resources. + # Equivalent matchPolicy ensures that non-v1 resource requests are sent to + # this webhook (after the resources have been converted to v1). + matchPolicy: Equivalent + timeoutSeconds: 30 + failurePolicy: Fail + sideEffects: None + clientConfig: + service: + name: cert-manager-webhook + namespace: cert-manager + path: /validate diff --git a/ci/k8s/infrastructure/cert-manager/kustomization.yaml b/ci/k8s/infrastructure/cert-manager/kustomization.yaml index b1ceb35..4f89636 100644 --- a/ci/k8s/infrastructure/cert-manager/kustomization.yaml +++ b/ci/k8s/infrastructure/cert-manager/kustomization.yaml @@ -1,5 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml + - install.yaml - cluster-issuer.yaml diff --git a/ci/known_hosts b/ci/known_hosts new file mode 100644 index 0000000..36f3488 --- /dev/null +++ b/ci/known_hosts @@ -0,0 +1 @@ +[git.ermnvldmr.com]:22222,[45.150.33.239]:22222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXcvf3Lds3AKfGHGh00IWR9tSRbBBqrV/CC6JBGmcrD diff --git a/ci/packer/scripts/02-install-k3s.sh b/ci/packer/scripts/02-install-k3s.sh index aca4926..c14ded3 100755 --- a/ci/packer/scripts/02-install-k3s.sh +++ b/ci/packer/scripts/02-install-k3s.sh @@ -9,7 +9,8 @@ export INSTALL_K3S_SKIP_START="true" export INSTALL_K3S_VERSION="v1.31.2+k3s1" # Download official K3s installer and install binary/systemd unit without starting -curl -sfL https://get.k3s.io | sh - +install -m 0755 /tmp/scripts/k3s /usr/local/bin/k3s +INSTALL_K3S_SKIP_DOWNLOAD=true sh /tmp/scripts/k3s-install.sh # Verify k3s binary is located in /usr/local/bin which k3s @@ -28,6 +29,7 @@ chmod 644 /etc/rancher/k3s/config.yaml # Pre-stage default GitOps root sync manifest mkdir -p /etc/flux +install -m 0644 /tmp/scripts/flux-install.yaml /etc/flux/install.yaml cat << 'EOF' > /etc/flux/cluster-sync.yaml apiVersion: source.toolkit.fluxcd.io/v1 kind: GitRepository @@ -36,7 +38,7 @@ metadata: namespace: flux-system spec: interval: 1m - url: https://github.com/deytenit/ermnvldmr.com.git + url: https://git.ermnvldmr.com/deytenit/ermnvldmr.com.git ref: branch: next --- @@ -119,7 +121,7 @@ else fi echo "=== [Bootstrap] Installing Flux Operator / Custom Resources ===" -kubectl apply -k "https://github.com/fluxcd/flux2/manifests/install?ref=v2.4.0" || true +kubectl apply -f /etc/flux/install.yaml echo "=== [Bootstrap] Applying initial GitOps root sync ===" if [ -f /etc/flux/cluster-sync.yaml ]; then diff --git a/ci/scripts/await-rollout.sh b/ci/scripts/await-rollout.sh new file mode 100755 index 0000000..31be554 --- /dev/null +++ b/ci/scripts/await-rollout.sh @@ -0,0 +1,63 @@ +#!/bin/bash +set -euo pipefail + +SERVICE="${1:-}" +TARGET_COMMIT="${2:-}" +ENDPOINT="${3:-https://${SERVICE}.ermnvldmr.com/version.json}" + +if [ -z "$SERVICE" ] || [ -z "$TARGET_COMMIT" ]; then + echo "Usage: $0 [endpoint_url]" >&2 + exit 1 +fi + +echo "========================================================" +echo "Verifying production deployment on $ENDPOINT" +echo "Expected commit: $TARGET_COMMIT" +echo "========================================================" + +MAX_ATTEMPTS=45 +ATTEMPT=1 +CF_BLOCKED_COUNT=0 + +while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do + echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..." + + RESP_FILE=$(mktemp) + HTTP_CODE=$(curl -sL --max-time 10 \ + -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" \ + -H "Accept: application/json" \ + -o "$RESP_FILE" \ + -w "%{http_code}" \ + "$ENDPOINT" || echo "000") + + if [ "$HTTP_CODE" = "200" ]; then + LIVE_COMMIT=$(jq -r '.commit // empty' "$RESP_FILE" 2>/dev/null || true) + echo " Live commit: ${LIVE_COMMIT:-}" + + if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then + echo "✅ Success! Production $SERVICE has successfully rolled out $TARGET_COMMIT." + rm -f "$RESP_FILE" + exit 0 + fi + elif [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "503" ]; then + echo " HTTP $HTTP_CODE: Cloudflare WAF/challenge encountered from runner IP." + CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT + 1)) + else + echo " HTTP $HTTP_CODE: Endpoint returned unexpected status code or timed out." + fi + + rm -f "$RESP_FILE" + + if [ $CF_BLOCKED_COUNT -ge 5 ]; then + echo "⚠️ Cloudflare WAF consistently blocked external probe requests from this runner IP (HTTP $HTTP_CODE)." + echo "The GitOps release commit was already pushed to the repository; FluxCD will reconcile the cluster." + echo "Skipping further external HTTP verification to avoid false negative." + exit 0 + fi + + ATTEMPT=$((ATTEMPT + 1)) + sleep 10 +done + +echo "❌ Deployment verification timed out after 7.5 minutes." +exit 1 diff --git a/ci/scripts/build-golden-image.sh b/ci/scripts/build-golden-image.sh new file mode 100755 index 0000000..1c0cb1f --- /dev/null +++ b/ci/scripts/build-golden-image.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bash +set -euo pipefail + +mkdir -p output-qemu + +echo "Downloading official Debian 12 cloud image..." +curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2 + +echo "Expanding disk image to 10G..." +qemu-img resize base.qcow2 10G + +echo "Connecting disk image via NBD..." +sudo modprobe nbd max_part=8 +sudo qemu-nbd --connect=/dev/nbd0 base.qcow2 +sleep 1 +sudo partx -u /dev/nbd0 || true + +echo "Mounting disk filesystem..." +sudo mkdir -p /mnt/target +sudo mount /dev/nbd0p1 /mnt/target + +echo "Mounting host virtual filesystems and configuring DNS..." +sudo rm -f /mnt/target/etc/resolv.conf +echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf +echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf +sudo mount --bind /dev /mnt/target/dev +sudo mount --bind /dev/pts /mnt/target/dev/pts +sudo mount --bind /proc /mnt/target/proc +sudo mount --bind /sys /mnt/target/sys + +echo "Copying provisioner scripts..." +sudo mkdir -p /mnt/target/tmp/scripts +sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/ +sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/ +sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml +sudo chmod +x /mnt/target/tmp/scripts/*.sh + +echo "Running provisioner scripts in chroot..." +sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh +sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh +sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh +sudo rm -rf /mnt/target/tmp/scripts + +echo "Unmounting filesystems..." +sudo umount /mnt/target/sys +sudo umount /mnt/target/proc +sudo umount /mnt/target/dev/pts +sudo umount /mnt/target/dev +sudo umount /mnt/target +sudo qemu-nbd --disconnect /dev/nbd0 + +echo "Compressing and optimizing qcow2 with 2M cluster size..." +qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 +echo "Golden image built successfully." diff --git a/ci/scripts/cache.py b/ci/scripts/cache.py new file mode 100644 index 0000000..18c7048 --- /dev/null +++ b/ci/scripts/cache.py @@ -0,0 +1,87 @@ +import hashlib +import json +import os +import platform +import subprocess +import sys +import tarfile +import tempfile +import urllib.error +import urllib.parse +import urllib.request +import zipfile +from pathlib import Path + +SERVER='https://git.ermnvldmr.com' + + +def eligible(run, repository, current_run): + if run.get('repository',{}).get('full_name')!=repository: + return False + if str(run.get('id'))==current_run: + return True + return run.get('head_branch')=='next' and run.get('event') in ('push','workflow_dispatch') and run.get('status')=='completed' and run.get('conclusion')=='success' + + +def request(url): + if not url.startswith(SERVER+'/'): + raise ValueError('Unexpected cache artifact host') + class LocalRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self, req, fp, code, msg, headers, newurl): + if not newurl.startswith(SERVER+'/'): + raise ValueError('Unexpected cache storage host') + return super().redirect_request(req,fp,code,msg,headers,newurl) + req=urllib.request.Request(url,headers={'Authorization':'token '+os.environ['CACHE_TOKEN']}) + return urllib.request.build_opener(LocalRedirect).open(req,timeout=60) + + +def api(path): + with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+path) as response: + return json.load(response) + + +def main(): + store=Path(subprocess.check_output(['pnpm','store','path','--silent'],text=True).strip()) + archive=Path('.ci/pnpm-store.tar') + if sys.argv[1]=='pack': + archive.parent.mkdir(exist_ok=True) + store.mkdir(parents=True,exist_ok=True) + with tarfile.open(archive,'w') as target:target.add(store,arcname='.') + return + versions=subprocess.check_output(['node','--version'],text=True).strip()+'-'+subprocess.check_output(['pnpm','--version'],text=True).strip() + key='pnpm-'+platform.system().lower()+'-'+platform.machine()+'-'+versions+'-'+hashlib.sha256(Path('pnpm-lock.yaml').read_bytes()).hexdigest() + with open(os.environ['GITHUB_OUTPUT'],'a') as output:output.write('key='+key+'\n') + try: + artifacts=api('/actions/artifacts?name='+urllib.parse.quote(key))['artifacts'] + artifacts.sort(key=lambda a:a['id'],reverse=True) + for artifact in artifacts: + if artifact.get('expired',True) or artifact.get('name')!=key: + continue + run_id=artifact.get('workflow_run',{}).get('id') + if not run_id: + continue + run=api('/actions/runs/'+str(run_id)) + if not eligible(run,os.environ['GITHUB_REPOSITORY'],os.environ['GITHUB_RUN_ID']): + continue + with tempfile.TemporaryDirectory(prefix='pnpm-artifact-cache-') as directory: + downloaded=Path(directory)/'cache.zip' + with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+'/actions/artifacts/'+str(artifact['id'])+'/zip') as response,downloaded.open('wb') as target: + while chunk:=response.read(1048576):target.write(chunk) + with zipfile.ZipFile(downloaded) as zipped: + members=[name for name in zipped.namelist() if name.rsplit('/',1)[-1]=='pnpm-store.tar'] + if len(members)!=1: + raise ValueError('Invalid cache archive') + packed=Path(directory)/'store.tar' + with zipped.open(members[0]) as source,packed.open('wb') as target: + while chunk:=source.read(1048576):target.write(chunk) + store.mkdir(parents=True,exist_ok=True) + with tarfile.open(packed) as tar:tar.extractall(store,filter='data') + print('Restored repository-scoped pnpm cache artifact') + return + except (urllib.error.HTTPError,urllib.error.URLError,ValueError,tarfile.TarError,zipfile.BadZipFile): + print('Cache unavailable; dependencies will be fetched normally') + return + print('No eligible cache artifact; dependencies will be fetched normally') + + +if __name__=='__main__':main() diff --git a/ci/scripts/deploy-gitops.sh b/ci/scripts/deploy-gitops.sh index a323e34..4dd824b 100755 --- a/ci/scripts/deploy-gitops.sh +++ b/ci/scripts/deploy-gitops.sh @@ -19,17 +19,25 @@ fi echo "Updating Kustomize image tag for '$SERVICE' to '$TAG'..." cd "$APP_DIR" -kustomize edit set image "ghcr.io/deytenit/ermnvldmr.com/${SERVICE}:${TAG}" +IMAGE="git.ermnvldmr.com/deytenit/ermnvldmr.com/${SERVICE}" +if [[ "$TAG" =~ ^sha256:[0-9a-f]{64}$ ]]; then + kustomize edit set image "${IMAGE}=${IMAGE}@${TAG}" +elif [[ "$TAG" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then + kustomize edit set image "${IMAGE}=${IMAGE}:${TAG}" +else + echo "Invalid image digest or tag" >&2 + exit 1 +fi cd "$ROOT_DIR" -git config user.name "adam-at-deytenit" -git config user.email "221188529+adam-at-deytenit@users.noreply.github.com" +git config user.name "APEX CI" +git config user.email "adam@ermnvldmr.com" git add "ci/k8s/apps/${SERVICE}/kustomization.yaml" if git diff --staged --quiet; then echo "No manifest changes to commit for $SERVICE." else - git commit -m "chore(release): deploy ${SERVICE} ${TAG} [skip ci]" - git push origin next + git commit --no-gpg-sign -m "chore(release): deploy ${SERVICE} ${TAG} [skip ci]" + python3 "$ROOT_DIR/ci/scripts/git_write.py" HEAD:next echo "Successfully deployed $SERVICE ($TAG) via GitOps." fi diff --git a/ci/scripts/deploy-static.sh b/ci/scripts/deploy-static.sh index 6a70bce..e1afce0 100755 --- a/ci/scripts/deploy-static.sh +++ b/ci/scripts/deploy-static.sh @@ -31,11 +31,21 @@ fi export AWS_DEFAULT_REGION="$AWS_REGION" ENDPOINT_URL="${S3_ENDPOINT_URL%/}" -# Upload all static files -echo "Uploading static files..." -aws s3 cp "$DIST_DIR/" "s3://$S3_BUCKET/" \ - --recursive \ - --endpoint-url="$ENDPOINT_URL" \ - --cache-control "max-age=300" +# Set S3 max_concurrent_requests to 1 to prevent race conditions on S3-compatible endpoints +aws configure set default.s3.max_concurrent_requests 1 -echo "Static files deployed successfully!" +# Upload all static files with retry +echo "Uploading static files..." +for attempt in 1 2 3; do + echo "Attempt $attempt/3: syncing static files..." + if aws s3 sync "$DIST_DIR/" "s3://$S3_BUCKET/" \ + --endpoint-url="$ENDPOINT_URL" \ + --cache-control "max-age=300"; then + echo "Static files deployed successfully!" + exit 0 + fi + sleep 2 +done + +echo "Error: Failed to upload static files after 3 attempts." +exit 1 diff --git a/ci/scripts/docker.py b/ci/scripts/docker.py new file mode 100644 index 0000000..a4f310c --- /dev/null +++ b/ci/scripts/docker.py @@ -0,0 +1,64 @@ +import json +import os +import re +import subprocess +import sys +from pathlib import Path + + +def lines(value): + return [line.strip() for line in value.splitlines() if line.strip()] + + +def output(name, value): + with open(os.environ['GITHUB_OUTPUT'], 'a') as stream: + stream.write(f'{name}< 1024 * 1024: + raise ValueError('Unexpected provenance artifact size') + with zipfile.ZipFile(io.BytesIO(payload)) as archive: + members = [name for name in archive.namelist() if name.rsplit('/', 1)[-1] == filename] + if len(members) != 1: + raise ValueError('Missing or ambiguous provenance manifest') + if archive.getinfo(members[0]).file_size > 65536: + raise ValueError('Unexpected provenance document size') + return json.loads(archive.read(members[0])) + + +def main(): + sha, digest, run_id = os.environ['TESTED_SHA'], os.environ['TESTED_DIGEST'], os.environ['BUILD_RUN_ID'] + validate_input(sha, digest, run_id) + current = api('/actions/runs/' + os.environ['GITHUB_RUN_ID']) + if current.get('event') != 'workflow_dispatch' or current.get('head_branch') != 'next': + raise ValueError('Approval must be manually dispatched on protected next') + actor = current.get('trigger_actor') or current.get('actor') or {} + if actor.get('login') != 'deytenit': + raise ValueError('Only the repository owner may approve promotion') + if not api('/branches/next').get('protected'): + raise ValueError('The next branch must be protected before promotion') + validate_run(api('/actions/runs/' + run_id), sha) + validate_manifest(artifact_manifest(run_id), sha, digest, run_id) + if os.environ.get('RELEASE_RUN_ID'): + release_id = os.environ['RELEASE_RUN_ID'] + if not re.fullmatch(r'[1-9][0-9]*', release_id): + raise ValueError('Numeric release run ID required') + release = api('/actions/runs/' + release_id) + actor = release.get('trigger_actor') or release.get('actor') or {} + if release.get('conclusion') != 'success' or release.get('status') != 'completed' or release.get('event') != 'workflow_dispatch' or release.get('head_branch') != 'next' or release.get('path') != 'services-www-release-manual.yml@refs/heads/next' or actor.get('login') != 'deytenit': + raise ValueError('Successful independently approved release required') + manifest = artifact_manifest(release_id, 'www-release-provenance', 'www-release.json') + expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO, 'release_tag': os.environ['RELEASE_TAG']} + if manifest != expected: + raise ValueError('Release approval does not match requested artifact') + auth = base64.b64encode(('deytenit:' + os.environ['PROVENANCE_TOKEN']).encode()).decode() + subprocess.run(['git', '-c', 'http.https://git.ermnvldmr.com/.extraheader=AUTHORIZATION: basic ' + auth, 'fetch', 'origin', 'next'], check=True) + subprocess.run(['git', 'merge-base', '--is-ancestor', sha, 'origin/next'], check=True) + subprocess.run(['docker', 'pull', IMAGE + '@' + digest], check=True) + data = json.loads(subprocess.check_output(['docker', 'image', 'inspect', IMAGE + '@' + digest], text=True)) + validate_labels(data[0]['Config'].get('Labels') or {}, sha, run_id) + with open(os.environ['GITHUB_OUTPUT'], 'a') as stream: + stream.write('short_sha=sha-' + sha[:7] + '\n') + + +if __name__ == '__main__': + main() diff --git a/ci/scripts/setup-env.sh b/ci/scripts/setup-env.sh new file mode 100755 index 0000000..02c3c07 --- /dev/null +++ b/ci/scripts/setup-env.sh @@ -0,0 +1,35 @@ +#!/bin/bash +set -euo pipefail + +PNPM_VERSION="${1:-9.12.3}" +NODE_VERSION="${2:-20}" + +# Configure pnpm +case "$PNPM_VERSION" in + 8|9|9.12.3) ;; + *) echo "Unsupported pnpm version: $PNPM_VERSION" >&2; exit 1 ;; +esac + +PNPM_BIN="/opt/ci/pnpm/$PNPM_VERSION/bin" +if [ -d "$PNPM_BIN" ]; then + if [ -n "${GITHUB_PATH:-}" ]; then + echo "$PNPM_BIN" >> "$GITHUB_PATH" + fi + export PATH="$PNPM_BIN:$PATH" +fi + +# Configure Node.js +case "$NODE_VERSION" in + 18*) major=18 ;; + 20*) major=20 ;; + 22*) major=22 ;; + *) echo "Unsupported node version: $NODE_VERSION" >&2; exit 1 ;; +esac + +NODE_BIN="/opt/ci/node/$major/bin" +if [ -d "$NODE_BIN" ]; then + if [ -n "${GITHUB_PATH:-}" ]; then + echo "$NODE_BIN" >> "$GITHUB_PATH" + fi + export PATH="$NODE_BIN:$PATH" +fi diff --git a/ci/scripts/upload-golden-image.sh b/ci/scripts/upload-golden-image.sh new file mode 100755 index 0000000..ce36cf5 --- /dev/null +++ b/ci/scripts/upload-golden-image.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -euo pipefail + +IMAGE_NAME="${1:-com-ermnvldmr-debian-12-k3s-amd64.qcow2}" +mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 "output-qemu/${IMAGE_NAME}" + +if [ -n "${S3_BUCKET:-}" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ]; then + ENDPOINT_FLAG="" + [ -n "${S3_ENDPOINT:-}" ] && ENDPOINT_FLAG="--endpoint-url=${S3_ENDPOINT}" + echo "Cleaning up older images in dev/images/ to free bucket storage..." + aws ${ENDPOINT_FLAG} s3 rm "s3://${S3_BUCKET}/dev/images/" --recursive --exclude "*" --include "com-ermnvldmr-debian-12-k3s-*.qcow2" || true + aws ${ENDPOINT_FLAG} s3 cp "output-qemu/${IMAGE_NAME}" "s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}" + echo "Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}" +else + echo "S3 storage secrets not provided; skipping remote S3 upload. Image artifact is preserved in workflow run artifacts." +fi diff --git a/codecov.yml b/codecov.yml deleted file mode 100644 index f0a3e3d..0000000 --- a/codecov.yml +++ /dev/null @@ -1,53 +0,0 @@ -codecov: - notify: - wait_for_ci: true - -ignore: - - 'packages/eslint-config' - - 'packages/rsbuild-config' - - 'packages/storybook-config' - -coverage: - status: - project: - default: - target: 80% - threshold: 1% - range: 10% - stl: - target: 80% - flags: - - stl - ui: - target: 80% - flags: - - ui - ui-storybook: - target: 80% - flags: - - ui-storybook - www: - target: 80% - flags: - - www - www-storybook: - target: 80% - flags: - - www-storybook - -flags: - stl: - paths: - - packages/stl - ui: - paths: - - packages/ui - ui-storybook: - paths: - - packages/ui - www: - paths: - - services/www - www-storybook: - paths: - - services/www