diff --git a/.codespellignore b/.codespellignore index 0e0a18f4fae0..db62c0bb64eb 100644 --- a/.codespellignore +++ b/.codespellignore @@ -12,3 +12,4 @@ AfterAll SME uptodate enbale +lifecyle diff --git a/Makefile b/Makefile index af3905b76d35..5b7191551bd2 100644 --- a/Makefile +++ b/Makefile @@ -245,7 +245,7 @@ $(MOCKGEN): ${TOOLS_DIR}/go.mod $(VERIFY_API_DEPS): $(TOOLS_DIR)/go.mod $(VERIFY_API_DEPS_SRC) # Build verify-api-deps tool cd $(TOOLS_DIR); $(GO) build -o $(BIN_DIR)/verify-api-deps ./verify-api-deps -$(CRD_SCHEMA_CHECK): $(TOOLS_DIR)/go.mod # Build crd-schema-check tool +$(CRD_SCHEMA_CHECK): $(TOOLS_DIR)/go.mod $(wildcard $(TOOLS_DIR)/crd-schema-check/*.go) # Build crd-schema-check tool cd $(TOOLS_DIR); $(GO) build -o $(BIN_DIR)/crd-schema-check ./crd-schema-check .PHONY: generate diff --git a/api/go.mod b/api/go.mod index 244d3e227c88..648228d917f1 100644 --- a/api/go.mod +++ b/api/go.mod @@ -3,7 +3,7 @@ module github.com/openshift/hypershift/api go 1.26.0 require ( - github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 + github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c k8s.io/api v0.37.1 k8s.io/apimachinery v0.37.1 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 diff --git a/api/go.sum b/api/go.sum index dc16f15d42de..12ace67b0c4f 100644 --- a/api/go.sum +++ b/api/go.sum @@ -24,8 +24,6 @@ github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7F github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs= github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM= github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= -github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI= -github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag= github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU= github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk= github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY= @@ -56,6 +54,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -68,8 +68,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus= github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= -github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 h1:/sDj4rzzTkN8i3Vug/+PxIjp1duKft9GdnhK5hb/yRk= -github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= +github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c h1:htIaa9XrrcLWrDZIhIbSHA3GBjRbirC+0BVwHRhPrFI= +github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c/go.mod h1:2oI3aXQFDjjl7l4xA9ZPSkB+l+lyfWLg7P2sWg9yEvM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= diff --git a/api/hypershift/v1beta1/kms_serialization_test.go b/api/hypershift/v1beta1/kms_serialization_test.go new file mode 100644 index 000000000000..1f867caf0408 --- /dev/null +++ b/api/hypershift/v1beta1/kms_serialization_test.go @@ -0,0 +1,74 @@ +package v1beta1 + +import ( + "encoding/json" + "testing" + + configv1 "github.com/openshift/api/config/v1" +) + +func TestClusterConfigurationKMSPluginConfigRoundTrip(t *testing.T) { + tests := []struct { + name string + kind string + }{ + { + name: "When HostedCluster has a KMS pluginConfig reference, it should preserve it through typed JSON round trips", + kind: "HostedCluster", + }, + { + name: "When HostedControlPlane has a KMS pluginConfig reference, it should preserve it through typed JSON round trips", + kind: "HostedControlPlane", + }, + } + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + input := []byte(`{"spec":{"configuration":{"apiServer":{"encryption":{"type":"KMS","kms":{"pluginConfig":{"apiVersion":"config.openshift.io/v1","resource":"vaultkmsconfigs","name":"cluster"}}}}}}}`) + var original, roundTrip any + var configuration **ClusterConfiguration + if test.kind == "HostedCluster" { + original = &HostedCluster{} + cluster := &HostedCluster{} + roundTrip = cluster + configuration = &cluster.Spec.Configuration + } else { + original = &HostedControlPlane{} + controlPlane := &HostedControlPlane{} + roundTrip = controlPlane + configuration = &controlPlane.Spec.Configuration + } + if err := json.Unmarshal(input, original); err != nil { + t.Fatalf("decode typed resource: %v", err) + } + encoded, err := json.Marshal(original) + if err != nil { + t.Fatalf("encode typed resource: %v", err) + } + if err := json.Unmarshal(encoded, roundTrip); err != nil { + t.Fatalf("decode round trip: %v", err) + } + if *configuration == nil || (*configuration).APIServer == nil { + t.Fatal("round trip lost API server configuration") + } + encryption := (*configuration).APIServer.Encryption + if encryption.Type != configv1.EncryptionType("KMS") { + t.Fatalf("unexpected encryption type: %q", encryption.Type) + } + expected := configv1.KMSPluginConfigReference{ + APIVersion: "config.openshift.io/v1", + Resource: "vaultkmsconfigs", + Name: "cluster", + } + if encryption.KMS.PluginConfig != expected { + t.Fatalf("unexpected pluginConfig: got %#v, want %#v", encryption.KMS.PluginConfig, expected) + } + kmsJSON, err := json.Marshal(encryption.KMS) + if err != nil { + t.Fatalf("encode KMS configuration: %v", err) + } + if string(kmsJSON) != `{"pluginConfig":{"apiVersion":"config.openshift.io/v1","resource":"vaultkmsconfigs","name":"cluster"}}` { + t.Fatalf("unexpected KMS wire format: %s", kmsJSON) + } + }) + } +} diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml index 19d162013302..cb9ff3ea3c49 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml @@ -708,298 +708,64 @@ spec: managing the lifecyle of the encryption keys outside of the control plane. This allows integration with an external provider to manage the data encryption keys securely. properties: - type: - description: |- - type defines the kind of platform for the KMS provider. - Allowed values are Vault. - When set to Vault, the plugin connects to a HashiCorp Vault server for key management. - enum: - - Vault - type: string - vault: + pluginConfig: description: |- - vault defines the configuration for the Vault KMS plugin. - The plugin connects to a Vault Enterprise server that is managed - by the user outside the purview of the control plane. - This field must be set when type is Vault, and must be unset otherwise. + pluginConfig is a required reference to a cluster-scoped resource with a status subresource + that satisfies the OpenShift KMS plugin configuration status interface. properties: - authentication: - description: authentication defines the authentication - method used to authenticate with Vault. - properties: - appRole: - description: |- - appRole defines the configuration for AppRole authentication. - This field must be set when type is AppRole, and must be unset otherwise. - properties: - secret: - description: |- - secret references a secret in the openshift-config namespace containing - the AppRole credentials used to authenticate with Vault. - The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID. - properties: - name: - description: |- - name is the metadata.name of the referenced secret in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS - subdomain name: contain no more - than 253 characters, contain only - lowercase alphanumeric characters, - ''-'' or ''.'', and start and - end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - required: - - secret - type: object - type: - description: |- - type defines the authentication method used to authenticate with Vault. - Allowed values are AppRole. - When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault. - enum: - - AppRole - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: appRole config is required when authentication - type is AppRole, and forbidden otherwise - rule: 'self.type == ''AppRole'' ? has(self.appRole) - : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with - a valid '@sha256:' suffix, where '' - is 64 characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the - host[:port][/namespace]/name format, resembling - a valid URL without the scheme. Short names - are not allowed, the registry hostname must - be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) - tls: + apiVersion: description: |- - tls contains the TLS configuration for connecting to the Vault server. - When this field is not set, system default TLS settings are used. - minProperties: 1 - properties: - caBundle: - description: |- - caBundle references a ConfigMap in the openshift-config namespace containing - the CA certificate bundle used to verify the TLS connection to the Vault server. - The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt". - When this field is not set, the system's trusted CA certificates are used. - - The namespace for the ConfigMap is openshift-config. - - Example ConfigMap: - apiVersion: v1 - kind: ConfigMap - metadata: - name: vault-ca-bundle - namespace: openshift-config - data: - ca-bundle.crt: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - properties: - name: - description: |- - name is the metadata.name of the referenced ConfigMap in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS subdomain - name: contain no more than 253 characters, - contain only lowercase alphanumeric - characters, ''-'' or ''.'', and start - and end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - serverName: - description: |- - serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS. - This is useful when the Vault server's hostname doesn't match its TLS certificate. - When this field is not set, the hostname from vaultAddress is used for SNI. - - The value must be a valid DNS hostname: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'serverName must be a valid DNS - hostname: contain no more than 253 characters, - contain only lowercase alphanumeric characters, - ''-'' or ''.'', and start and end with - an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - type: object - vaultAddress: - description: |- - vaultAddress specifies the address of the HashiCorp Vault instance. - The value must be a valid HTTPS URL containing only scheme, host, and optional port. - Paths, user info, query parameters, and fragments are not allowed. - - Format: https://hostname[:port] - Example: https://vault.example.com:8200 - - The value must be between 1 and 512 characters. - maxLength: 512 + apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + The value must be in the format /, where group is a DNS subdomain + and version is a Kubernetes API version (for example, v1 or v1alpha1). + It must contain between 1 and 64 characters. + maxLength: 64 minLength: 1 type: string x-kubernetes-validations: - - message: must be a valid URL - rule: isURL(self) - - message: must use the 'https' scheme - rule: isURL(self) && url(self).getScheme() == - 'https' - - message: must not contain a path - rule: isURL(self) && (url(self).getEscapedPath() - == '' || url(self).getEscapedPath() == '/') - - message: must not have a query - rule: isURL(self) && url(self).getQuery() == - {} - - message: must not have a fragment - rule: self.find('#(.+)$') == '' - - message: must not have user info - rule: self.find('@') == '' - vaultAuthNamespace: + - message: apiVersion must be in the format / + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$') + name: description: |- - vaultAuthNamespace specifies the Vault namespace to use for authentication. - This is only applicable for Vault Enterprise installations where authentication - and Transit operations may be in different namespaces. - When this field is not set, the value of vaultNamespace is used for both - authentication and Transit key operations. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + name is required and is the metadata.name of the referenced KMS plugin configuration resource. + The referenced resource must be cluster-scoped. + The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + maxLength: 253 minLength: 1 type: string x-kubernetes-validations: - - message: vaultAuthNamespace cannot end with - a forward slash - rule: '!self.endsWith(''/'')' - - message: vaultAuthNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultAuthNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' - vaultKeyPath: + - message: 'name must be a valid DNS subdomain + name: contain no more than 253 characters, + contain only lowercase alphanumeric characters, + ''-'' or ''.'', and start and end with an + alphanumeric character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') + resource: description: |- - vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, - combining the Transit engine mount path and the key name separated by "/keys/". - Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). - - The total path length must be between 8 and 1542 characters. - The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) - and forward slashes as path separators, and must not contain "." or ".." path segments. - The key name must start and end with an alphanumeric character or underscore, and may contain - alphanumeric characters, underscores, hyphens, and periods in the middle. - maxLength: 1542 - minLength: 8 - type: string - x-kubernetes-validations: - - message: vaultKeyPath cannot start with a forward - slash - rule: '!self.startsWith(''/'')' - - message: vaultKeyPath cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultKeyPath cannot contain consecutive - forward slashes - rule: '!self.contains(''//'')' - - message: vaultKeyPath must only contain RFC - 3986 unreserved characters (alphanumeric, - hyphen, period, underscore, tilde) and forward - slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') - - message: vaultKeyPath must not contain '.' or - '..' path segments - rule: self.split('/').filter(s, s == '.' || - s == '..').size() == 0 - - message: vaultKeyPath must follow the format - /keys/ where the key name - starts and ends with an alphanumeric character - or underscore and may contain alphanumeric - characters, underscores, hyphens, and periods - rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') - vaultNamespace: - description: |- - vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. - This is only applicable for Vault Enterprise installations. - When this field is not set, no namespace is used. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + not the Kind (for example, VaultKMSConfig). + The value must be between 1 and 63 characters, contain only lowercase alphanumeric + characters or '-', and start and end with an alphanumeric character. + maxLength: 63 minLength: 1 type: string x-kubernetes-validations: - - message: vaultNamespace cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' + - message: 'resource must be a valid Kubernetes + resource name: contain no more than 63 characters, + contain only lowercase alphanumeric characters + or ''-'', and start and end with an alphanumeric + character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?$') required: - - authentication - - kmsPluginImage - - vaultAddress - - vaultKeyPath + - apiVersion + - name + - resource type: object required: - - type + - pluginConfig type: object - x-kubernetes-validations: - - message: vault config is required when kms provider - type is Vault, and forbidden otherwise - rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)' type: description: |- type defines what encryption type should be used to encrypt resources at the datastore layer. diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml index ac5c33d85345..04ce9d37f177 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml @@ -655,298 +655,64 @@ spec: managing the lifecyle of the encryption keys outside of the control plane. This allows integration with an external provider to manage the data encryption keys securely. properties: - type: - description: |- - type defines the kind of platform for the KMS provider. - Allowed values are Vault. - When set to Vault, the plugin connects to a HashiCorp Vault server for key management. - enum: - - Vault - type: string - vault: + pluginConfig: description: |- - vault defines the configuration for the Vault KMS plugin. - The plugin connects to a Vault Enterprise server that is managed - by the user outside the purview of the control plane. - This field must be set when type is Vault, and must be unset otherwise. + pluginConfig is a required reference to a cluster-scoped resource with a status subresource + that satisfies the OpenShift KMS plugin configuration status interface. properties: - authentication: - description: authentication defines the authentication - method used to authenticate with Vault. - properties: - appRole: - description: |- - appRole defines the configuration for AppRole authentication. - This field must be set when type is AppRole, and must be unset otherwise. - properties: - secret: - description: |- - secret references a secret in the openshift-config namespace containing - the AppRole credentials used to authenticate with Vault. - The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID. - properties: - name: - description: |- - name is the metadata.name of the referenced secret in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS - subdomain name: contain no more - than 253 characters, contain only - lowercase alphanumeric characters, - ''-'' or ''.'', and start and - end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - required: - - secret - type: object - type: - description: |- - type defines the authentication method used to authenticate with Vault. - Allowed values are AppRole. - When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault. - enum: - - AppRole - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: appRole config is required when authentication - type is AppRole, and forbidden otherwise - rule: 'self.type == ''AppRole'' ? has(self.appRole) - : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with - a valid '@sha256:' suffix, where '' - is 64 characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the - host[:port][/namespace]/name format, resembling - a valid URL without the scheme. Short names - are not allowed, the registry hostname must - be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) - tls: + apiVersion: description: |- - tls contains the TLS configuration for connecting to the Vault server. - When this field is not set, system default TLS settings are used. - minProperties: 1 - properties: - caBundle: - description: |- - caBundle references a ConfigMap in the openshift-config namespace containing - the CA certificate bundle used to verify the TLS connection to the Vault server. - The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt". - When this field is not set, the system's trusted CA certificates are used. - - The namespace for the ConfigMap is openshift-config. - - Example ConfigMap: - apiVersion: v1 - kind: ConfigMap - metadata: - name: vault-ca-bundle - namespace: openshift-config - data: - ca-bundle.crt: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - properties: - name: - description: |- - name is the metadata.name of the referenced ConfigMap in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS subdomain - name: contain no more than 253 characters, - contain only lowercase alphanumeric - characters, ''-'' or ''.'', and start - and end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - serverName: - description: |- - serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS. - This is useful when the Vault server's hostname doesn't match its TLS certificate. - When this field is not set, the hostname from vaultAddress is used for SNI. - - The value must be a valid DNS hostname: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'serverName must be a valid DNS - hostname: contain no more than 253 characters, - contain only lowercase alphanumeric characters, - ''-'' or ''.'', and start and end with - an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - type: object - vaultAddress: - description: |- - vaultAddress specifies the address of the HashiCorp Vault instance. - The value must be a valid HTTPS URL containing only scheme, host, and optional port. - Paths, user info, query parameters, and fragments are not allowed. - - Format: https://hostname[:port] - Example: https://vault.example.com:8200 - - The value must be between 1 and 512 characters. - maxLength: 512 + apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + The value must be in the format /, where group is a DNS subdomain + and version is a Kubernetes API version (for example, v1 or v1alpha1). + It must contain between 1 and 64 characters. + maxLength: 64 minLength: 1 type: string x-kubernetes-validations: - - message: must be a valid URL - rule: isURL(self) - - message: must use the 'https' scheme - rule: isURL(self) && url(self).getScheme() == - 'https' - - message: must not contain a path - rule: isURL(self) && (url(self).getEscapedPath() - == '' || url(self).getEscapedPath() == '/') - - message: must not have a query - rule: isURL(self) && url(self).getQuery() == - {} - - message: must not have a fragment - rule: self.find('#(.+)$') == '' - - message: must not have user info - rule: self.find('@') == '' - vaultAuthNamespace: + - message: apiVersion must be in the format / + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$') + name: description: |- - vaultAuthNamespace specifies the Vault namespace to use for authentication. - This is only applicable for Vault Enterprise installations where authentication - and Transit operations may be in different namespaces. - When this field is not set, the value of vaultNamespace is used for both - authentication and Transit key operations. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + name is required and is the metadata.name of the referenced KMS plugin configuration resource. + The referenced resource must be cluster-scoped. + The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + maxLength: 253 minLength: 1 type: string x-kubernetes-validations: - - message: vaultAuthNamespace cannot end with - a forward slash - rule: '!self.endsWith(''/'')' - - message: vaultAuthNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultAuthNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' - vaultKeyPath: + - message: 'name must be a valid DNS subdomain + name: contain no more than 253 characters, + contain only lowercase alphanumeric characters, + ''-'' or ''.'', and start and end with an + alphanumeric character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') + resource: description: |- - vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, - combining the Transit engine mount path and the key name separated by "/keys/". - Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). - - The total path length must be between 8 and 1542 characters. - The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) - and forward slashes as path separators, and must not contain "." or ".." path segments. - The key name must start and end with an alphanumeric character or underscore, and may contain - alphanumeric characters, underscores, hyphens, and periods in the middle. - maxLength: 1542 - minLength: 8 - type: string - x-kubernetes-validations: - - message: vaultKeyPath cannot start with a forward - slash - rule: '!self.startsWith(''/'')' - - message: vaultKeyPath cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultKeyPath cannot contain consecutive - forward slashes - rule: '!self.contains(''//'')' - - message: vaultKeyPath must only contain RFC - 3986 unreserved characters (alphanumeric, - hyphen, period, underscore, tilde) and forward - slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') - - message: vaultKeyPath must not contain '.' or - '..' path segments - rule: self.split('/').filter(s, s == '.' || - s == '..').size() == 0 - - message: vaultKeyPath must follow the format - /keys/ where the key name - starts and ends with an alphanumeric character - or underscore and may contain alphanumeric - characters, underscores, hyphens, and periods - rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') - vaultNamespace: - description: |- - vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. - This is only applicable for Vault Enterprise installations. - When this field is not set, no namespace is used. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + not the Kind (for example, VaultKMSConfig). + The value must be between 1 and 63 characters, contain only lowercase alphanumeric + characters or '-', and start and end with an alphanumeric character. + maxLength: 63 minLength: 1 type: string x-kubernetes-validations: - - message: vaultNamespace cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' + - message: 'resource must be a valid Kubernetes + resource name: contain no more than 63 characters, + contain only lowercase alphanumeric characters + or ''-'', and start and end with an alphanumeric + character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?$') required: - - authentication - - kmsPluginImage - - vaultAddress - - vaultKeyPath + - apiVersion + - name + - resource type: object required: - - type + - pluginConfig type: object - x-kubernetes-validations: - - message: vault config is required when kms provider - type is Vault, and forbidden otherwise - rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)' type: description: |- type defines what encryption type should be used to encrypt resources at the datastore layer. diff --git a/api/vendor/github.com/openshift/api/config/v1/types_cluster_version.go b/api/vendor/github.com/openshift/api/config/v1/types_cluster_version.go index 9cb85f4c0033..d7097f904dc1 100644 --- a/api/vendor/github.com/openshift/api/config/v1/types_cluster_version.go +++ b/api/vendor/github.com/openshift/api/config/v1/types_cluster_version.go @@ -18,8 +18,8 @@ import ( // +kubebuilder:object:root=true // +kubebuilder:subresource:status // +kubebuilder:resource:path=clusterversions,scope=Cluster -// +openshift:validation:FeatureGateAwareXValidation:featureGate="";CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" -// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" +// +openshift:validation:FeatureGateAwareXValidation:featureGate="";CRDCompatibilityRequirementOperator,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" +// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIOperator,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" // +kubebuilder:printcolumn:name=Version,JSONPath=.status.history[?(@.state=="Completed")].version,type=string // +kubebuilder:printcolumn:name=Available,JSONPath=.status.conditions[?(@.type=="Available")].status,type=string // +kubebuilder:printcolumn:name=Progressing,JSONPath=.status.conditions[?(@.type=="Progressing")].status,type=string @@ -307,8 +307,7 @@ const ( // ClusterVersionCapability enumerates optional, core cluster components. // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 // +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements -// +openshift:validation:FeatureGateAwareEnum:featureGate=ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI -// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI +// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI type ClusterVersionCapability string const ( diff --git a/api/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/api/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index 857f9b27929b..a0375adff819 100644 --- a/api/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/api/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -71,6 +71,22 @@ type InfrastructureSpec struct { // +kubebuilder:validation:Enum=HighlyAvailable;SingleReplica // +optional ControlPlaneTopology TopologyMode `json:"controlPlaneTopology,omitempty"` + + // infrastructureTopology expresses the desired topology for infrastructure + // services that do not run on control plane nodes, indicating how + // infrastructure workloads are distributed across nodes. + // + // When omitted, no topology transition override has been expressed. + // Once populated, the field represents the desired topology state. + // + // When the value differs from status.infrastructureTopology, the cluster + // evaluates whether the requested transition can proceed. Not all + // transitions may be permitted. + // + // +openshift:enable:FeatureGate=MutableTopology + // +kubebuilder:validation:Enum=HighlyAvailable;SingleReplica + // +optional + InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` } // InfrastructureStatus describes the infrastructure the cluster is leveraging. @@ -138,6 +154,16 @@ type InfrastructureStatus struct { // +optional InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` + // topologyTransitionStatus reports evaluations of supported topology transitions + // and the status of a requested transition, if any. + // It is optional and is omitted until the topology controller reports transition status. + // A transition is requested through spec.controlPlaneTopology. The controller + // reports completion only after both topologies reach that transition's target + // and post-transition checks pass; reaching the target topology alone is not completion. + // +openshift:enable:FeatureGate=MutableTopology + // +optional + TopologyTransitionStatus TopologyTransitionStatus `json:"topologyTransitionStatus,omitzero"` + // cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. // CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. // Valid values are "None" and "AllNodes". When omitted, the default value is "None". diff --git a/api/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go b/api/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go new file mode 100644 index 000000000000..113d3b211636 --- /dev/null +++ b/api/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go @@ -0,0 +1,170 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// TopologyState describes the control-plane and infrastructure topology at one +// end of a topology transition. +// The topology controller determines which transitions are supported. Currently, +// it supports only transitions that change both topologies from SingleReplica to +// HighlyAvailable. Representing a topology here does not enable a transition to it. +type TopologyState struct { + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. HighlyAvailable means multiple instances are expected + // to provide redundancy. HighlyAvailableArbiter means two control-plane nodes + // and a smaller arbiter node to maintain quorum. + // See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for + // topology definitions. + // controlPlaneTopology is required. + // +kubebuilder:validation:Enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica + // +required + ControlPlaneTopology TopologyMode `json:"controlPlaneTopology,omitempty"` + + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // infrastructureTopology is required. + // +kubebuilder:validation:Enum=SingleReplica;HighlyAvailable + // +required + InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` +} + +const ( + // TopologyTransitionsEvaluatedConditionType indicates whether supported transition types have been evaluated. + // + // The controller always reports this condition when topologyTransitionStatus is + // set. It reports Unknown before evaluation and while checks are being refreshed, + // True when evaluation finishes successfully (even if no transitions are supported + // or available), and False when evaluation cannot finish. It retains the last + // results while refreshing checks or reporting an evaluation failure. Clients + // must treat those results as stale unless this condition is True. + TopologyTransitionsEvaluatedConditionType = "TopologyTransitionsEvaluated" + + // TopologyTransitionCompletedConditionType indicates the status of the current or most recent transition. + // + // The controller always reports this condition when topologyTransitionStatus is + // set. It reports Unknown before a transition is requested, True after both + // topologies reach the requested transition's target and post-transition checks + // pass, and False while the transition is in progress or blocked. + // Reaching the target topology alone does not mean the transition is complete: + // this condition remains False while post-transition checks are pending or failing. + TopologyTransitionCompletedConditionType = "TopologyTransitionCompleted" + + // TopologyTransitionAvailableConditionType indicates if a type of transition is available based on + // the most recently evaluated state of the cluster. + // + // TopologyTransitionAvailableConditionType is Unknown before evaluation, True when evaluations + // for the given transition succeed, and False when one or more evaluations for a transition fail. + // Because the controller clears transitions whenever TopologyTransitionsEvaluated is not True, + // a reported value always reflects the current evaluation, never a stale one. + TopologyTransitionAvailableConditionType = "TopologyTransitionAvailable" +) + +// TopologyTransitionStatus reports availability of each type of topology transition and contains the +// status of any initiated transition. +// +kubebuilder:validation:MinProperties=1 +type TopologyTransitionStatus struct { + // conditions provides information on topology transition progress and the + // evaluation of supported transition types. The controller always reports both + // conditions once topologyTransitionStatus is set. + // + // Valid condition types are TopologyTransitionsEvaluated and + // TopologyTransitionCompleted. Both conditions must be present: the controller + // always reports each condition explicitly, using Unknown when a condition's + // state is not yet known, rather than omitting it. + // + // +kubebuilder:validation:MinItems=2 + // +kubebuilder:validation:MaxItems=2 + // +kubebuilder:validation:XValidation:rule="self.all(c, c.type in ['TopologyTransitionsEvaluated', 'TopologyTransitionCompleted'])",message="conditions may only contain TopologyTransitionsEvaluated and TopologyTransitionCompleted" + // +optional + // +listType=map + // +listMapKey=type + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // transitions contains each supported transition type and its availability. + // It is optional. The controller clears this list whenever + // TopologyTransitionsEvaluated is not True, so its presence always reflects + // current, trustworthy results: an omitted list while TopologyTransitionsEvaluated + // is True means no supported transition options were found, and an omitted list + // otherwise means no transition options have been reported yet. + // + // Between one and eight transition options must be present when the list is set. + // This list reports transition options, not concurrent transitions. The topology + // controller determines which transition options are supported. + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=8 + // +optional + // +listType=atomic + Transitions []TopologyTransition `json:"transitions,omitempty"` +} + +type TopologyTransition struct { + // source is the control-plane and infrastructure topology this transition was + // evaluated from. It may differ from the current topology while status is + // being refreshed. External control planes cannot be a transition source. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // source is required. + // +required + Source TopologyState `json:"source,omitempty,omitzero"` + + // target is the control-plane and infrastructure topology this transition would + // move to. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // External control planes cannot be a transition target. + // target is required. + // +required + Target TopologyState `json:"target,omitempty,omitzero"` + + // evaluations contains the availability condition for this transition and + // conditions for the checks run against the cluster to determine availability. + // + // TopologyTransitionAvailable is required; other condition types report + // individual checks. Between one and 32 conditions must be present, allowing + // at most 31 individual checks in addition to the availability condition. + // The controller defines individual check types, reasons, and messages, and + // always reports each one explicitly, using Unknown when a check's result is + // not yet known. + // + // +kubebuilder:validation:MaxItems=32 + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'TopologyTransitionAvailable')",message="evaluations must contain TopologyTransitionAvailable" + // +required + // +listType=map + // +listMapKey=type + Evaluations []metav1.Condition `json:"evaluations,omitempty"` +} diff --git a/api/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go b/api/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go index e2f94ae1f37d..1511d149cf36 100644 --- a/api/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go +++ b/api/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go @@ -2,25 +2,29 @@ package v1 // KMSPluginConfig defines the configuration for the KMS instance // that will be used with KMS encryption -// +kubebuilder:validation:XValidation:rule="self.type == 'Vault' ? has(self.vault) : !has(self.vault)",message="vault config is required when kms provider type is Vault, and forbidden otherwise" -// +union type KMSPluginConfig struct { - // type defines the kind of platform for the KMS provider. - // Allowed values are Vault. - // When set to Vault, the plugin connects to a HashiCorp Vault server for key management. + // --- TOMBSTONE --- + // type was the kind of platform for the KMS provider. + // The field has been replaced by the provider-specific pluginConfig resource. + // The field name is reserved to prevent reuse. // - // +unionDiscriminator // +required - Type KMSProviderType `json:"type"` + // Type KMSProviderType `json:"type"` - // vault defines the configuration for the Vault KMS plugin. - // The plugin connects to a Vault Enterprise server that is managed - // by the user outside the purview of the control plane. - // This field must be set when type is Vault, and must be unset otherwise. + // pluginConfig is a required reference to a cluster-scoped resource with a status subresource + // that satisfies the OpenShift KMS plugin configuration status interface. + // + // +required + PluginConfig KMSPluginConfigReference `json:"pluginConfig,omitzero"` + + // --- TOMBSTONE --- + // vault defined inline Vault-specific KMS plugin configuration. + // It has been replaced by pluginConfig which references a provider-managed custom resource. + // The field name is reserved to prevent reuse. // // +unionMember // +optional - Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"` + // Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"` // --- TOMBSTONE --- // aws was a field that allowed configuring AWS KMS. @@ -31,6 +35,43 @@ type KMSPluginConfig struct { // AWS *AWSKMSConfig `json:"aws,omitempty"` } +// KMSPluginConfigReference identifies a cluster-scoped KMS plugin configuration custom resource. +type KMSPluginConfigReference struct { + // apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + // The value must be in the format /, where group is a DNS subdomain + // and version is a Kubernetes API version (for example, v1 or v1alpha1). + // It must contain between 1 and 64 characters. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$')",message="apiVersion must be in the format /" + // +required + APIVersion string `json:"apiVersion,omitempty"` + + // resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + // This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + // not the Kind (for example, VaultKMSConfig). + // The value must be between 1 and 63 characters, contain only lowercase alphanumeric + // characters or '-', and start and end with an alphanumeric character. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?$')",message="resource must be a valid Kubernetes resource name: contain no more than 63 characters, contain only lowercase alphanumeric characters or '-', and start and end with an alphanumeric character" + // +required + Resource string `json:"resource,omitempty"` + + // name is required and is the metadata.name of the referenced KMS plugin configuration resource. + // The referenced resource must be cluster-scoped. + // The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + // contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +required + Name string `json:"name,omitempty"` +} + // --- TOMBSTONE --- // AWSKMSConfig was a type for AWS KMS configuration that was never implemented. // The type name is reserved to prevent reuse. diff --git a/api/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go b/api/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go index 5df50e2f60d0..cf71d7a1d53e 100644 --- a/api/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go +++ b/api/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go @@ -3820,6 +3820,7 @@ func (in *InfrastructureStatus) DeepCopyInto(out *InfrastructureStatus) { *out = new(PlatformStatus) (*in).DeepCopyInto(*out) } + in.TopologyTransitionStatus.DeepCopyInto(&out.TopologyTransitionStatus) return } @@ -4065,7 +4066,7 @@ func (in *IntermediateTLSProfile) DeepCopy() *IntermediateTLSProfile { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KMSPluginConfig) DeepCopyInto(out *KMSPluginConfig) { *out = *in - out.Vault = in.Vault + out.PluginConfig = in.PluginConfig return } @@ -4079,6 +4080,22 @@ func (in *KMSPluginConfig) DeepCopy() *KMSPluginConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPluginConfigReference) DeepCopyInto(out *KMSPluginConfigReference) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPluginConfigReference. +func (in *KMSPluginConfigReference) DeepCopy() *KMSPluginConfigReference { + if in == nil { + return nil + } + out := new(KMSPluginConfigReference) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KeystoneIdentityProvider) DeepCopyInto(out *KeystoneIdentityProvider) { *out = *in @@ -6853,6 +6870,77 @@ func (in *TokenUserValidationRule) DeepCopy() *TokenUserValidationRule { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyState) DeepCopyInto(out *TopologyState) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyState. +func (in *TopologyState) DeepCopy() *TopologyState { + if in == nil { + return nil + } + out := new(TopologyState) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyTransition) DeepCopyInto(out *TopologyTransition) { + *out = *in + out.Source = in.Source + out.Target = in.Target + if in.Evaluations != nil { + in, out := &in.Evaluations, &out.Evaluations + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyTransition. +func (in *TopologyTransition) DeepCopy() *TopologyTransition { + if in == nil { + return nil + } + out := new(TopologyTransition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyTransitionStatus) DeepCopyInto(out *TopologyTransitionStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Transitions != nil { + in, out := &in.Transitions, &out.Transitions + *out = make([]TopologyTransition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyTransitionStatus. +func (in *TopologyTransitionStatus) DeepCopy() *TopologyTransitionStatus { + if in == nil { + return nil + } + out := new(TopologyTransitionStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Update) DeepCopyInto(out *Update) { *out = *in diff --git a/api/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/api/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index 09c8665a8f2f..f4162097dfa9 100644 --- a/api/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/api/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -166,8 +166,7 @@ clusterversions.config.openshift.io: Category: "" FeatureGates: - CRDCompatibilityRequirementOperator - - CRDCompatibilityRequirementOperator+ClusterAPIMachineManagement - - ClusterAPIMachineManagement + - CRDCompatibilityRequirementOperator+ClusterAPIOperator - ClusterUpdateAcceptRisks - ClusterUpdatePreflight - ImageStreamImportMode diff --git a/api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go b/api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go index 043c03ef5efb..c10808e7a8e8 100644 --- a/api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go +++ b/api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go @@ -870,6 +870,11 @@ func (in KMSPluginConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.KMSPluginConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPluginConfigReference) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.KMSPluginConfigReference" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in KeystoneIdentityProvider) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.KeystoneIdentityProvider" @@ -1455,6 +1460,21 @@ func (in TokenUserValidationRule) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.TokenUserValidationRule" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyState) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyState" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyTransition) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyTransition" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyTransitionStatus) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyTransitionStatus" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in Update) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.Update" diff --git a/api/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/api/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index aa7c2ee88215..7fb77382adc4 100644 --- a/api/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/api/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -1871,10 +1871,11 @@ func (InfrastructureList) SwaggerDoc() map[string]string { } var map_InfrastructureSpec = map[string]string{ - "": "InfrastructureSpec contains settings that apply to the cluster infrastructure.", - "cloudConfig": "cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file. This configuration file is used to configure the Kubernetes cloud provider integration when using the built-in cloud provider integration or the external cloud controller manager. The namespace for this config map is openshift-config.\n\ncloudConfig should only be consumed by the kube_cloud_config controller. The controller is responsible for using the user configuration in the spec for various platforms and combining that with the user provided ConfigMap in this field to create a stitched kube cloud config. The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace with the kube cloud config is stored in `cloud.conf` key. All the clients are expected to use the generated ConfigMap only.", - "platformSpec": "platformSpec holds desired information specific to the underlying infrastructure provider.", - "controlPlaneTopology": "controlPlaneTopology expresses the desired topology configuration for control nodes.\n\nWhen status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable', a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.\n\nWhen left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value, no changes are required and no transitions will be triggered.\n\nThis value may be set to match status.controlPlaneTopology regardless of the current value.", + "": "InfrastructureSpec contains settings that apply to the cluster infrastructure.", + "cloudConfig": "cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file. This configuration file is used to configure the Kubernetes cloud provider integration when using the built-in cloud provider integration or the external cloud controller manager. The namespace for this config map is openshift-config.\n\ncloudConfig should only be consumed by the kube_cloud_config controller. The controller is responsible for using the user configuration in the spec for various platforms and combining that with the user provided ConfigMap in this field to create a stitched kube cloud config. The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace with the kube cloud config is stored in `cloud.conf` key. All the clients are expected to use the generated ConfigMap only.", + "platformSpec": "platformSpec holds desired information specific to the underlying infrastructure provider.", + "controlPlaneTopology": "controlPlaneTopology expresses the desired topology configuration for control nodes.\n\nWhen status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable', a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.\n\nWhen left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value, no changes are required and no transitions will be triggered.\n\nThis value may be set to match status.controlPlaneTopology regardless of the current value.", + "infrastructureTopology": "infrastructureTopology expresses the desired topology for infrastructure services that do not run on control plane nodes, indicating how infrastructure workloads are distributed across nodes.\n\nWhen omitted, no topology transition override has been expressed. Once populated, the field represents the desired topology state.\n\nWhen the value differs from status.infrastructureTopology, the cluster evaluates whether the requested transition can proceed. Not all transitions may be permitted.", } func (InfrastructureSpec) SwaggerDoc() map[string]string { @@ -1882,16 +1883,17 @@ func (InfrastructureSpec) SwaggerDoc() map[string]string { } var map_InfrastructureStatus = map[string]string{ - "": "InfrastructureStatus describes the infrastructure the cluster is leveraging.", - "infrastructureName": "infrastructureName uniquely identifies a cluster with a human friendly name. Once set it should not be changed. Must be of max length 27 and must have only alphanumeric or hyphen characters.", - "platform": "platform is the underlying infrastructure provider for the cluster.\n\nDeprecated: Use platformStatus.type instead.", - "platformStatus": "platformStatus holds status information specific to the underlying infrastructure provider.", - "etcdDiscoveryDomain": "etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering etcd servers and clients. For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.", - "apiServerURL": "apiServerURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerURL can be used by components like the web console to tell users where to find the Kubernetes API.", - "apiServerInternalURI": "apiServerInternalURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components like kubelets, to contact the Kubernetes API server using the infrastructure provider rather than Kubernetes networking.", - "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", - "infrastructureTopology": "infrastructureTopology expresses the expectations for infrastructure services that do not run on control plane nodes, usually indicated by a node selector for a `role` value other than `master`. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation NOTE: External topology mode is not applicable for this field.", - "cpuPartitioning": "cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. Valid values are \"None\" and \"AllNodes\". When omitted, the default value is \"None\". The default value of \"None\" indicates that no nodes will be setup with CPU partitioning. The \"AllNodes\" value indicates that all nodes have been setup with CPU partitioning, and can then be further configured via the PerformanceProfile API.", + "": "InfrastructureStatus describes the infrastructure the cluster is leveraging.", + "infrastructureName": "infrastructureName uniquely identifies a cluster with a human friendly name. Once set it should not be changed. Must be of max length 27 and must have only alphanumeric or hyphen characters.", + "platform": "platform is the underlying infrastructure provider for the cluster.\n\nDeprecated: Use platformStatus.type instead.", + "platformStatus": "platformStatus holds status information specific to the underlying infrastructure provider.", + "etcdDiscoveryDomain": "etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering etcd servers and clients. For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.", + "apiServerURL": "apiServerURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerURL can be used by components like the web console to tell users where to find the Kubernetes API.", + "apiServerInternalURI": "apiServerInternalURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components like kubelets, to contact the Kubernetes API server using the infrastructure provider rather than Kubernetes networking.", + "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", + "infrastructureTopology": "infrastructureTopology expresses the expectations for infrastructure services that do not run on control plane nodes, usually indicated by a node selector for a `role` value other than `master`. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation NOTE: External topology mode is not applicable for this field.", + "topologyTransitionStatus": "topologyTransitionStatus reports evaluations of supported topology transitions and the status of a requested transition, if any. It is optional and is omitted until the topology controller reports transition status. A transition is requested through spec.controlPlaneTopology. The controller reports completion only after both topologies reach that transition's target and post-transition checks pass; reaching the target topology alone is not completion.", + "cpuPartitioning": "cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. Valid values are \"None\" and \"AllNodes\". When omitted, the default value is \"None\". The default value of \"None\" indicates that no nodes will be setup with CPU partitioning. The \"AllNodes\" value indicates that all nodes have been setup with CPU partitioning, and can then be further configured via the PerformanceProfile API.", } func (InfrastructureStatus) SwaggerDoc() map[string]string { @@ -2271,6 +2273,36 @@ func (VSpherePlatformVCenterSpec) SwaggerDoc() map[string]string { return map_VSpherePlatformVCenterSpec } +var map_TopologyState = map[string]string{ + "": "TopologyState describes the control-plane and infrastructure topology at one end of a topology transition. The topology controller determines which transitions are supported. Currently, it supports only transitions that change both topologies from SingleReplica to HighlyAvailable. Representing a topology here does not enable a transition to it.", + "controlPlaneTopology": "controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. controlPlaneTopology is required.", + "infrastructureTopology": "infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. infrastructureTopology is required.", +} + +func (TopologyState) SwaggerDoc() map[string]string { + return map_TopologyState +} + +var map_TopologyTransition = map[string]string{ + "source": "source is the control-plane and infrastructure topology this transition was evaluated from. It may differ from the current topology while status is being refreshed. External control planes cannot be a transition source. controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. source is required.", + "target": "target is the control-plane and infrastructure topology this transition would move to. controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. External control planes cannot be a transition target. target is required.", + "evaluations": "evaluations contains the availability condition for this transition and conditions for the checks run against the cluster to determine availability.\n\nTopologyTransitionAvailable is required; other condition types report individual checks. Between one and 32 conditions must be present, allowing at most 31 individual checks in addition to the availability condition. The controller defines individual check types, reasons, and messages, and always reports each one explicitly, using Unknown when a check's result is not yet known.", +} + +func (TopologyTransition) SwaggerDoc() map[string]string { + return map_TopologyTransition +} + +var map_TopologyTransitionStatus = map[string]string{ + "": "TopologyTransitionStatus reports availability of each type of topology transition and contains the status of any initiated transition.", + "conditions": "conditions provides information on topology transition progress and the evaluation of supported transition types. The controller always reports both conditions once topologyTransitionStatus is set.\n\nValid condition types are TopologyTransitionsEvaluated and TopologyTransitionCompleted. Both conditions must be present: the controller always reports each condition explicitly, using Unknown when a condition's state is not yet known, rather than omitting it.", + "transitions": "transitions contains each supported transition type and its availability. It is optional. The controller clears this list whenever TopologyTransitionsEvaluated is not True, so its presence always reflects current, trustworthy results: an omitted list while TopologyTransitionsEvaluated is True means no supported transition options were found, and an omitted list otherwise means no transition options have been reported yet.\n\nBetween one and eight transition options must be present when the list is set. This list reports transition options, not concurrent transitions. The topology controller determines which transition options are supported.", +} + +func (TopologyTransitionStatus) SwaggerDoc() map[string]string { + return map_TopologyTransitionStatus +} + var map_AWSIngressSpec = map[string]string{ "": "AWSIngressSpec holds the desired state of the Ingress for Amazon Web Services infrastructure provider. This only includes fields that can be modified in the cluster.", "type": "type allows user to set a load balancer type. When this field is set the default ingresscontroller will get created using the specified LBType. If this field is not set then the default ingress controller of LBType Classic will be created. Valid values are:\n\n* \"Classic\": A Classic Load Balancer that makes routing decisions at either\n the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See\n the following for additional details:\n\n https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb\n\n* \"NLB\": A Network Load Balancer that makes routing decisions at the\n transport layer (TCP/SSL). See the following for additional details:\n\n https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb", @@ -2466,15 +2498,25 @@ func (Storage) SwaggerDoc() map[string]string { } var map_KMSPluginConfig = map[string]string{ - "": "KMSPluginConfig defines the configuration for the KMS instance that will be used with KMS encryption", - "type": "type defines the kind of platform for the KMS provider. Allowed values are Vault. When set to Vault, the plugin connects to a HashiCorp Vault server for key management.", - "vault": "vault defines the configuration for the Vault KMS plugin. The plugin connects to a Vault Enterprise server that is managed by the user outside the purview of the control plane. This field must be set when type is Vault, and must be unset otherwise.", + "": "KMSPluginConfig defines the configuration for the KMS instance that will be used with KMS encryption", + "pluginConfig": "pluginConfig is a required reference to a cluster-scoped resource with a status subresource that satisfies the OpenShift KMS plugin configuration status interface.", } func (KMSPluginConfig) SwaggerDoc() map[string]string { return map_KMSPluginConfig } +var map_KMSPluginConfigReference = map[string]string{ + "": "KMSPluginConfigReference identifies a cluster-scoped KMS plugin configuration custom resource.", + "apiVersion": "apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. The value must be in the format /, where group is a DNS subdomain and version is a Kubernetes API version (for example, v1 or v1alpha1). It must contain between 1 and 64 characters.", + "resource": "resource is required and is the resource name of the referenced KMS plugin configuration custom resource. This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), not the Kind (for example, VaultKMSConfig). The value must be between 1 and 63 characters, contain only lowercase alphanumeric characters or '-', and start and end with an alphanumeric character.", + "name": "name is required and is the metadata.name of the referenced KMS plugin configuration resource. The referenced resource must be cluster-scoped. The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", +} + +func (KMSPluginConfigReference) SwaggerDoc() map[string]string { + return map_KMSPluginConfigReference +} + var map_VaultAppRoleAuthentication = map[string]string{ "": "VaultAppRoleAuthentication defines the configuration for AppRole authentication with Vault.", "secret": "secret references a secret in the openshift-config namespace containing the AppRole credentials used to authenticate with Vault. The referenced Secret must contain two keys: \"role-id\" for the AppRole Role ID and \"secret-id\" for the AppRole Secret ID.", diff --git a/api/vendor/github.com/openshift/api/operator/v1/register.go b/api/vendor/github.com/openshift/api/operator/v1/register.go index 5920c4fca71d..7825af99f621 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/register.go +++ b/api/vendor/github.com/openshift/api/operator/v1/register.go @@ -70,6 +70,8 @@ func addKnownTypes(scheme *runtime.Scheme) error { &ServiceCatalogAPIServerList{}, &ServiceCatalogControllerManager{}, &ServiceCatalogControllerManagerList{}, + &Ingress{}, + &IngressList{}, &IngressController{}, &IngressControllerList{}, &InsightsOperator{}, diff --git a/api/vendor/github.com/openshift/api/operator/v1/types_console.go b/api/vendor/github.com/openshift/api/operator/v1/types_console.go index 35795b2b71b8..0e5d00382edf 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/types_console.go +++ b/api/vendor/github.com/openshift/api/operator/v1/types_console.go @@ -35,6 +35,19 @@ type Console struct { // ConsoleSpec is the specification of the desired behavior of the Console. type ConsoleSpec struct { OperatorSpec `json:",inline"` + + // authProxy configures proxy settings for outbound connections made by + // Console's OIDC login clients, including discovery, JWKS retrieval, + // code exchange, and token refresh. When set, it replaces the cluster-wide + // proxy (proxy.config.openshift.io/cluster) entirely for these connections; + // individual fields are not inherited from the cluster-wide configuration. + // At least one of httpProxy or httpsProxy must be specified. + // When omitted, the cluster-wide proxy is used if configured; otherwise no + // proxy is used. Other Console clients retain their existing proxy settings. + // +openshift:enable:FeatureGate=AuthenticationComponentProxyExternalOIDC + // +optional + AuthProxy ConsoleAuthProxyConfig `json:"authProxy,omitzero"` + // customization is used to optionally provide a small set of // customization options to the web console. // +optional @@ -54,13 +67,90 @@ type ConsoleSpec struct { // +optional Route ConsoleConfigRoute `json:"route"` // plugins defines a list of enabled console plugin names. + // +listType=atomic // +optional Plugins []string `json:"plugins,omitempty"` // ingress allows to configure the alternative ingress for the console. // This field is intended for clusters without ingress capability, // where access to routes is not possible. // +optional - Ingress Ingress `json:"ingress"` + Ingress ConsoleIngress `json:"ingress"` +} + +// ConsoleAuthProxyConfig holds proxy configuration scoped to Console's OIDC login clients. +// At least one of httpProxy or httpsProxy must be specified. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="has(self.httpProxy) || has(self.httpsProxy)",message="at least one of httpProxy or httpsProxy must be specified" +type ConsoleAuthProxyConfig struct { + // httpProxy is the URL of the proxy for HTTP requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="httpProxy must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() in ['http', 'https']",message="httpProxy must use http or https scheme" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || size(url(self).getHostname()) > 0",message="httpProxy must contain a hostname" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/'",message="httpProxy must not contain a path" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getQuery().size() == 0",message="httpProxy must not contain query parameters" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*#.*')",message="httpProxy must not contain a fragment" + // +optional + HTTPProxy string `json:"httpProxy,omitempty"` + + // httpsProxy is the URL of the proxy for HTTPS requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="httpsProxy must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() in ['http', 'https']",message="httpsProxy must use http or https scheme" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || size(url(self).getHostname()) > 0",message="httpsProxy must contain a hostname" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/'",message="httpsProxy must not contain a path" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getQuery().size() == 0",message="httpsProxy must not contain query parameters" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*#.*')",message="httpsProxy must not contain a fragment" + // +optional + HTTPSProxy string `json:"httpsProxy,omitempty"` + + // noProxy is a list of hostnames and/or CIDRs and/or IPs for which + // the proxy should not be used. Must contain at least one entry + // when set. Each entry must be between 1 and 253 characters long + // and at most 64 entries are allowed. Duplicate + // entries are not permitted. Entries that are not valid hostnames, + // CIDRs, or IPs are silently ignored. Cluster-internal defaults + // (.cluster.local, .svc, 127.0.0.1, localhost) are always appended + // automatically and do not need to be included. + // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=64 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=253 + // +optional + NoProxy []string `json:"noProxy,omitempty"` + + // trustedCA is a reference to a ConfigMap in the openshift-config + // namespace containing a CA certificate bundle under the key + // "ca-bundle.crt". This bundle is appended to the system trust store + // used by Console's OIDC login clients for proxy TLS connections. + // When omitted, only the system trust store is used. + // +optional + TrustedCA ConsoleAuthProxyTrustedCAConfigMapReference `json:"trustedCA,omitzero"` +} + +// ConsoleAuthProxyTrustedCAConfigMapReference references a ConfigMap in the +// openshift-config namespace. +type ConsoleAuthProxyTrustedCAConfigMapReference struct { + // name is the metadata.name of the referenced ConfigMap. + // Must be a valid DNS subdomain name (RFC 1123): at most 253 + // characters, only lowercase alphanumeric characters, '-' or + // '.', starting and ending with an alphanumeric character. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +required + Name string `json:"name,omitempty"` } // ConsoleConfigRoute holds information on external route access to console. @@ -344,6 +434,7 @@ type ConsoleCustomization struct { type ProjectAccess struct { // availableClusterRoles is the list of ClusterRole names that are assignable to users // through the project access tab. + // +listType=atomic // +optional AvailableClusterRoles []string `json:"availableClusterRoles,omitempty"` } @@ -390,6 +481,7 @@ type DeveloperConsoleCatalogTypes struct { // DeveloperConsoleCatalogCustomization allow cluster admin to configure developer catalog. type DeveloperConsoleCatalogCustomization struct { // categories which are shown in the developer catalog. + // +listType=atomic // +optional Categories []DeveloperConsoleCatalogCategory `json:"categories,omitempty"` // types allows enabling or disabling of sub-catalog types that user can see in the Developer catalog. @@ -414,6 +506,7 @@ type DeveloperConsoleCatalogCategoryMeta struct { Label string `json:"label"` // tags is a list of strings that will match the category. A selected category // show all items which has at least one overlapping tag between category and item. + // +listType=atomic // +optional Tags []string `json:"tags,omitempty"` } @@ -423,6 +516,7 @@ type DeveloperConsoleCatalogCategory struct { // defines top level category ID, label and filter tags. DeveloperConsoleCatalogCategoryMeta `json:",inline"` // subcategories defines a list of child categories. + // +listType=atomic // +optional Subcategories []DeveloperConsoleCatalogCategoryMeta `json:"subcategories,omitempty"` } @@ -430,6 +524,7 @@ type DeveloperConsoleCatalogCategory struct { // QuickStarts allow cluster admins to customize available ConsoleQuickStart resources. type QuickStarts struct { // disabled is a list of ConsoleQuickStart resource names that are not shown to users. + // +listType=atomic // +optional Disabled []string `json:"disabled,omitempty"` } @@ -439,6 +534,7 @@ type AddPage struct { // disabledActions is a list of actions that are not shown to users. // Each action in the list is represented by its ID. // +kubebuilder:validation:MinItems=1 + // +listType=atomic // +optional DisabledActions []string `json:"disabledActions,omitempty"` } @@ -460,9 +556,11 @@ const ( // +kubebuilder:validation:MinProperties:=1 type ResourceAttributesAccessReview struct { // required defines a list of permission checks. The perspective will only be shown when all checks are successful. When omitted, the access review is skipped and the perspective will not be shown unless it is required to do so based on the configuration of the missing access review list. + // +listType=atomic // +optional Required []authorizationv1.ResourceAttributes `json:"required"` // missing defines a list of permission checks. The perspective will only be shown when at least one check fails. When omitted, the access review is skipped and the perspective will not be shown unless it is required to do so based on the configuration of the required access review list. + // +listType=atomic // +optional Missing []authorizationv1.ResourceAttributes `json:"missing"` } @@ -498,6 +596,7 @@ type Perspective struct { // The console will also provide a configuration UI and a YAML snippet that will list the available resources that can be pinned to the navigation. // Incorrect or unknown resources will be ignored. // +kubebuilder:validation:MaxItems=100 + // +listType=atomic // +optional PinnedResources *[]PinnedResourceReference `json:"pinnedResources,omitempty"` } @@ -559,7 +658,7 @@ const ( ) // Ingress allows cluster admin to configure alternative ingress for the console. -type Ingress struct { +type ConsoleIngress struct { // consoleURL is a URL to be used as the base console address. // If not specified, the console route hostname will be used. // This field is required for clusters without ingress capability, diff --git a/api/vendor/github.com/openshift/api/operator/v1/types_ingress.go b/api/vendor/github.com/openshift/api/operator/v1/types_ingress.go new file mode 100644 index 000000000000..a031b4e57e46 --- /dev/null +++ b/api/vendor/github.com/openshift/api/operator/v1/types_ingress.go @@ -0,0 +1,146 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// Ingress contains configuration options specific to the Ingress Operator itself, +// including how it manages Gateway API integration. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +// +openshift:file-pattern=cvoRunLevel=0000_50,operatorName=ingress,operatorOrdering=02 +// +kubebuilder:object:root=true +// +kubebuilder:resource:path=ingresses,scope=Cluster +// +kubebuilder:subresource:status +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2890 +// +openshift:capability=Ingress +// +openshift:enable:FeatureGate=GatewayAPIManagementMode +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="Ingress is a singleton; the .metadata.name field must be 'cluster'" +type Ingress struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +required + metav1.ObjectMeta `json:"metadata"` + + // spec holds user settable values for configuration. + // +required + Spec IngressSpec `json:"spec,omitzero"` + + // status holds observed values from the cluster. + // +optional + Status IngressStatus `json:"status,omitzero"` +} + +// IngressSpec is the specification of the desired behavior of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type IngressSpec struct { + // gatewayAPI holds configuration for Gateway API integration, including how the + // ingress operator manages Gateway API CRDs, the OpenShift Gateway API + // implementation, and its Gateway API controllers. + // + // +optional + GatewayAPI GatewayAPIIngressConfig `json:"gatewayAPI,omitzero"` +} + +// IngressStatus defines the observed status of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.observedGeneration) || (has(self.observedGeneration) && self.observedGeneration >= oldSelf.observedGeneration)",message="observedGeneration must remain set and only increase once set" +type IngressStatus struct { + // conditions is a list of conditions and their status. + // + // Gateway API CRD management conditions are reported here with the "GatewayAPI" prefix: + // + // * "GatewayAPICRDsManaged" indicates whether the ingress operator is actively + // managing Gateway API CRDs. + // * "GatewayAPICRDsPresent" indicates whether Gateway API CRDs exist on the + // cluster. + // * "GatewayAPICRDsCompliant" indicates whether the installed CRDs match the + // version expected by this ingress operator release. + // + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + // +optional + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // observedGeneration represents the most recent generation observed by the operator and specifies the version of + // the spec field currently being synced. + // + // When omitted, the operator has not yet observed the resource. + // +optional + // +kubebuilder:validation:Minimum=1 + ObservedGeneration int64 `json:"observedGeneration,omitempty"` +} + +// GatewayAPIIngressConfig holds configuration for Gateway API integration in the +// Cluster Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type GatewayAPIIngressConfig struct { + // managementMode specifies how the Cluster Ingress Operator manages Gateway API + // Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, + // and its Gateway API controllers. + // + // Allowed values are "Managed" and "Unmanaged". + // + // When omitted or set to "Managed", the ingress operator installs, owns, and + // upgrades the Gateway API CRDs, protects them with a Validating Admission + // Policy, and deploys the OpenShift Gateway API implementation and its Gateway + // API controllers. + // + // When set to "Unmanaged", the ingress operator does not install or manage + // Gateway API CRDs and does not deploy the OpenShift Gateway API implementation + // or its Gateway API controllers. The cluster administrator or a third-party + // product is responsible for providing their own CRDs and Gateway controller. + // The ingress operator reports observational status only. + // + // +optional + ManagementMode GatewayAPIManagementMode `json:"managementMode,omitempty"` +} + +// GatewayAPIManagementMode describes how the Cluster Ingress Operator manages +// Gateway API Custom Resource Definitions. +// +kubebuilder:validation:Enum=Managed;Unmanaged +type GatewayAPIManagementMode string + +const ( + // GatewayAPIManagementModeManaged means the ingress operator installs, owns, + // protects (via a Validating Admission Policy), and upgrades the Gateway API + // CRDs, deploys the OpenShift Gateway API implementation, and runs its Gateway + // API controllers. This is the default mode and the only fully supported + // configuration. + GatewayAPIManagementModeManaged GatewayAPIManagementMode = "Managed" + + // GatewayAPIManagementModeUnmanaged means the ingress operator does not + // install or manage Gateway API CRDs, does not deploy the OpenShift Gateway + // API implementation, and does not run its Gateway API controllers. The + // cluster administrator or a third-party product is responsible for bringing + // their own CRDs and Gateway controller. The ingress operator reports + // observational status only. + GatewayAPIManagementModeUnmanaged GatewayAPIManagementMode = "Unmanaged" +) + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// IngressList is a collection of Ingresses. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +type IngressList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + metav1.ListMeta `json:"metadata"` + + // items is a list of Ingresses. + // +optional + Items []Ingress `json:"items,omitempty"` +} diff --git a/api/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go b/api/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go index 3f6198bd8f19..151c88f7f81e 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go +++ b/api/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go @@ -389,19 +389,23 @@ type IngressControllerSpec struct { // haproxyVersion specifies the HAProxy version to use for this // IngressController. // - // OpenShift 5.0 introduces HAProxy 3.2 as its default version and supports - // HAProxy 2.8 from OpenShift 4.22 for migration purposes. When an OpenShift - // release introduces a new default HAProxy version, that HAProxy version - // becomes available as a pinnable value in subsequent OpenShift releases, - // providing a smooth migration path for administrators who want to defer - // HAProxy upgrades. - // - // Valid values for OpenShift 5.0: - // - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.0) - // - "3.2": Explicitly pins HAProxy 3.2 for preservation during cluster - // upgrades to future OpenShift releases - // - "2.8": Uses HAProxy 2.8 from OpenShift 4.22 (migration support, will - // be dropped in the next OpenShift release) + // OpenShift 5.1 uses HAProxy 3.2 as its default version and supports + // HAProxy 3.4 as an explicit, non-default opt-in. + // + // Valid values for OpenShift 5.1: + // - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.1) + // - "3.2": Uses the latest HAProxy 3.2.z available for this OpenShift + // release and pins the minor version. + // - "3.4": Uses the latest HAProxy 3.4.z available for this OpenShift + // release. This is an explicit opt-in; HAProxy 3.4 is not the default. + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default when this field is + // unset, while continuing to support "3.2" as an explicit selection. + // - OpenShift 5.3 plans to retire support for selecting HAProxy 3.2. + // + // Note: HAProxy 2.8 support has been dropped in OpenShift 5.1. Upgrading + // from OpenShift 5.0 with haproxyVersion set to "2.8" is blocked. // // If a specific HAProxy version is set and would become unsupported in a // target cluster upgrade, a preflight check will block the cluster upgrade @@ -2331,9 +2335,14 @@ type IngressControllerStatus struct { // spec.haproxyVersion field. When omitted, the effective value has not yet // been resolved by the operator or the feature is not enabled for this cluster. // - // Examples for OpenShift 5.0: - // - "3.2": Using HAProxy 3.2 - // - "2.8": Using HAProxy 2.8 + // Examples for OpenShift 5.1: + // - "3.2": Using the default HAProxy 3.2 + // - "3.4": Using the explicitly selected, non-default HAProxy 3.4 + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default while keeping + // HAProxy 3.2 selectable. + // - OpenShift 5.3 plans to retire HAProxy 3.2. // // +optional // +openshift:enable:FeatureGate=IngressControllerMultipleHAProxyVersions @@ -2411,13 +2420,13 @@ const ( // format. The allowed values are constrained by enum validation and vary by // OpenShift release. // -// +kubebuilder:validation:Enum="2.8";"3.2" +// +kubebuilder:validation:Enum="3.2";"3.4" type HAProxyVersion string const ( - // HAProxyVersion28 represents HAProxy 2.8, shipped with OpenShift 4.22. - HAProxyVersion28 HAProxyVersion = "2.8" - // HAProxyVersion32 represents HAProxy 3.2, introduced in OpenShift 5.0. HAProxyVersion32 HAProxyVersion = "3.2" + + // HAProxyVersion34 represents HAProxy 3.4, available as a non-default option in OpenShift 5.1. + HAProxyVersion34 HAProxyVersion = "3.4" ) diff --git a/api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go b/api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go index 51a981b71655..637a7888dbc7 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go +++ b/api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go @@ -142,6 +142,7 @@ const ( // KMSPreflightResult contains the outcome of a preflight validation. // // +openshift:compatibility-gen:level=1 +// +kubebuilder:validation:XValidation:rule="self.status != 'Succeeded' || has(self.remoteKeyID)",message="remoteKeyID is required when status is Succeeded" type KMSPreflightResult struct { // status indicates the outcome of the preflight check. // Succeeded means the KMS plugin responded to Status, Encrypt, and @@ -163,9 +164,12 @@ type KMSPreflightResult struct { // remoteKeyID is the remote key encryption key identifier from KMS v2 // StatusResponse.key_id. This is not a cryptographic key, but a unique // representation of the remote key used to encrypt data. - // The value must be between 1 and 1024 characters. + // When omitted, no remote key identifier is available. This is expected + // when status is Failed, for example when the KMS provider could not be + // reached. When status is Succeeded, remoteKeyID is required. + // When set, the value must be between 1 and 1024 characters. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=1024 - // +required + // +optional RemoteKeyID string `json:"remoteKeyID,omitempty"` } diff --git a/api/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go b/api/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go index 331c82f44dd4..e016d654e85f 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go +++ b/api/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go @@ -17,10 +17,14 @@ import ( // // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). // +openshift:compatibility-gen:level=1 -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any CAPI MachineSet MachineManager must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || !self.status.managedBootImagesStatus.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io') || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io'): true",message="when skew enforcement is in Automatic mode, any CAPI MachineSet MachineManager in managedBootImagesStatus must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinedeployments' && m.apiGroup == 'cluster.x-k8s.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinedeployments' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any CAPI MachineDeployment MachineManager must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || !self.status.managedBootImagesStatus.machineManagers.exists(m, m.resource == 'machinedeployments') || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinedeployments'): true",message="when skew enforcement is in Automatic mode, any CAPI MachineDeployment MachineManager in managedBootImagesStatus must use selection mode 'All'" type MachineConfiguration struct { metav1.TypeMeta `json:",inline"` @@ -74,7 +78,6 @@ type MachineConfigurationSpec struct { // a skew enforcement mode has been specified. // When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed // acceptable for the current release payload. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcement BootImageSkewEnforcementConfig `json:"bootImageSkewEnforcement,omitempty,omitzero"` } @@ -296,7 +299,6 @@ type MachineConfigurationStatus struct { // boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically // determine skew enforcement or there is an explicit skew enforcement configuration provided in the // spec.bootImageSkewEnforcement field. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcementStatus BootImageSkewEnforcementStatus `json:"bootImageSkewEnforcementStatus,omitempty,omitzero"` } @@ -398,6 +400,8 @@ type MachineManagerSelector struct { // Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. // Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. // None means that every resource matched by the machine manager will not be updated. + // When boot image skew enforcement is in Automatic mode, only All is permitted for the + // machinesets and machinedeployments resource types, in any API group. // +unionDiscriminator // +required Mode MachineManagerSelectorMode `json:"mode"` diff --git a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 2d4102745119..be972585d9e8 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -1055,6 +1055,44 @@ func (in *Console) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleAuthProxyConfig) DeepCopyInto(out *ConsoleAuthProxyConfig) { + *out = *in + if in.NoProxy != nil { + in, out := &in.NoProxy, &out.NoProxy + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.TrustedCA = in.TrustedCA + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleAuthProxyConfig. +func (in *ConsoleAuthProxyConfig) DeepCopy() *ConsoleAuthProxyConfig { + if in == nil { + return nil + } + out := new(ConsoleAuthProxyConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleAuthProxyTrustedCAConfigMapReference) DeepCopyInto(out *ConsoleAuthProxyTrustedCAConfigMapReference) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleAuthProxyTrustedCAConfigMapReference. +func (in *ConsoleAuthProxyTrustedCAConfigMapReference) DeepCopy() *ConsoleAuthProxyTrustedCAConfigMapReference { + if in == nil { + return nil + } + out := new(ConsoleAuthProxyTrustedCAConfigMapReference) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ConsoleConfigRoute) DeepCopyInto(out *ConsoleConfigRoute) { *out = *in @@ -1112,6 +1150,22 @@ func (in *ConsoleCustomization) DeepCopy() *ConsoleCustomization { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleIngress) DeepCopyInto(out *ConsoleIngress) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleIngress. +func (in *ConsoleIngress) DeepCopy() *ConsoleIngress { + if in == nil { + return nil + } + out := new(ConsoleIngress) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ConsoleList) DeepCopyInto(out *ConsoleList) { *out = *in @@ -1170,6 +1224,7 @@ func (in *ConsoleProviders) DeepCopy() *ConsoleProviders { func (in *ConsoleSpec) DeepCopyInto(out *ConsoleSpec) { *out = *in in.OperatorSpec.DeepCopyInto(&out.OperatorSpec) + in.AuthProxy.DeepCopyInto(&out.AuthProxy) in.Customization.DeepCopyInto(&out.Customization) in.Providers.DeepCopyInto(&out.Providers) out.Route = in.Route @@ -1861,6 +1916,22 @@ func (in *GCPLoadBalancerParameters) DeepCopy() *GCPLoadBalancerParameters { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GatewayAPIIngressConfig) DeepCopyInto(out *GatewayAPIIngressConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIIngressConfig. +func (in *GatewayAPIIngressConfig) DeepCopy() *GatewayAPIIngressConfig { + if in == nil { + return nil + } + out := new(GatewayAPIIngressConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *GatewayConfig) DeepCopyInto(out *GatewayConfig) { *out = *in @@ -2201,6 +2272,10 @@ func (in *IPv6OVNKubernetesConfig) DeepCopy() *IPv6OVNKubernetesConfig { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Ingress) DeepCopyInto(out *Ingress) { *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + out.Spec = in.Spec + in.Status.DeepCopyInto(&out.Status) return } @@ -2214,6 +2289,14 @@ func (in *Ingress) DeepCopy() *Ingress { return out } +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *Ingress) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IngressController) DeepCopyInto(out *IngressController) { *out = *in @@ -2670,6 +2753,79 @@ func (in *IngressControllerTuningOptions) DeepCopy() *IngressControllerTuningOpt return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressList) DeepCopyInto(out *IngressList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]Ingress, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressList. +func (in *IngressList) DeepCopy() *IngressList { + if in == nil { + return nil + } + out := new(IngressList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IngressList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressSpec) DeepCopyInto(out *IngressSpec) { + *out = *in + out.GatewayAPI = in.GatewayAPI + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressSpec. +func (in *IngressSpec) DeepCopy() *IngressSpec { + if in == nil { + return nil + } + out := new(IngressSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressStatus) DeepCopyInto(out *IngressStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressStatus. +func (in *IngressStatus) DeepCopy() *IngressStatus { + if in == nil { + return nil + } + out := new(IngressStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *InsightsOperator) DeepCopyInto(out *InsightsOperator) { *out = *in diff --git a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml index 083bf4940c29..a5750a18bb2b 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml @@ -114,7 +114,8 @@ consoles.operator.openshift.io: CRDName: consoles.operator.openshift.io Capability: "" Category: "" - FeatureGates: [] + FeatureGates: + - AuthenticationComponentProxyExternalOIDC FilenameOperatorName: console FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_50" @@ -172,6 +173,29 @@ etcds.operator.openshift.io: TopLevelFeatureGates: [] Version: v1 +ingresses.operator.openshift.io: + Annotations: {} + ApprovedPRNumber: https://github.com/openshift/api/pull/2890 + CRDName: ingresses.operator.openshift.io + Capability: Ingress + Category: "" + FeatureGates: + - GatewayAPIManagementMode + FilenameOperatorName: ingress + FilenameOperatorOrdering: "02" + FilenameRunLevel: "0000_50" + GroupName: operator.openshift.io + HasStatus: true + KindName: Ingress + Labels: {} + PluralName: ingresses + PrinterColumns: [] + Scope: Cluster + ShortNames: null + TopLevelFeatureGates: + - GatewayAPIManagementMode + Version: v1 + ingresscontrollers.operator.openshift.io: Annotations: {} ApprovedPRNumber: https://github.com/openshift/api/pull/616 @@ -311,7 +335,6 @@ machineconfigurations.operator.openshift.io: Capability: "" Category: "" FeatureGates: - - BootImageSkewEnforcement - IrreconcilableMachineConfig - ManagedBootImagesAWSCAPI - ManagedBootImagesCPMS diff --git a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go index 13ab0c5f6f29..37218e6dafb9 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go +++ b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go @@ -240,6 +240,16 @@ func (in Console) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.Console" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleAuthProxyConfig) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleAuthProxyConfig" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleAuthProxyTrustedCAConfigMapReference) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleAuthProxyTrustedCAConfigMapReference" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in ConsoleConfigRoute) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleConfigRoute" @@ -250,6 +260,11 @@ func (in ConsoleCustomization) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleCustomization" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleIngress) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleIngress" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in ConsoleList) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleList" @@ -410,6 +425,11 @@ func (in GCPLoadBalancerParameters) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.GCPLoadBalancerParameters" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in GatewayAPIIngressConfig) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.GatewayAPIIngressConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in GatewayConfig) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.GatewayConfig" @@ -585,6 +605,21 @@ func (in IngressControllerTuningOptions) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.IngressControllerTuningOptions" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressList) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressList" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressSpec) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressSpec" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressStatus) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressStatus" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in InsightsOperator) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.InsightsOperator" diff --git a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 309d84b07256..44f1a292c42c 100644 --- a/api/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/api/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -277,6 +277,27 @@ func (Console) SwaggerDoc() map[string]string { return map_Console } +var map_ConsoleAuthProxyConfig = map[string]string{ + "": "ConsoleAuthProxyConfig holds proxy configuration scoped to Console's OIDC login clients. At least one of httpProxy or httpsProxy must be specified.", + "httpProxy": "httpProxy is the URL of the proxy for HTTP requests. Must be a valid URL with http or https scheme, a non-empty hostname, and no path, query parameters, or fragment. Userinfo (e.g. user:password@host) is allowed for proxy authentication. Maximum length is 2048 characters.", + "httpsProxy": "httpsProxy is the URL of the proxy for HTTPS requests. Must be a valid URL with http or https scheme, a non-empty hostname, and no path, query parameters, or fragment. Userinfo (e.g. user:password@host) is allowed for proxy authentication. Maximum length is 2048 characters.", + "noProxy": "noProxy is a list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used. Must contain at least one entry when set. Each entry must be between 1 and 253 characters long and at most 64 entries are allowed. Duplicate entries are not permitted. Entries that are not valid hostnames, CIDRs, or IPs are silently ignored. Cluster-internal defaults (.cluster.local, .svc, 127.0.0.1, localhost) are always appended automatically and do not need to be included.", + "trustedCA": "trustedCA is a reference to a ConfigMap in the openshift-config namespace containing a CA certificate bundle under the key \"ca-bundle.crt\". This bundle is appended to the system trust store used by Console's OIDC login clients for proxy TLS connections. When omitted, only the system trust store is used.", +} + +func (ConsoleAuthProxyConfig) SwaggerDoc() map[string]string { + return map_ConsoleAuthProxyConfig +} + +var map_ConsoleAuthProxyTrustedCAConfigMapReference = map[string]string{ + "": "ConsoleAuthProxyTrustedCAConfigMapReference references a ConfigMap in the openshift-config namespace.", + "name": "name is the metadata.name of the referenced ConfigMap. Must be a valid DNS subdomain name (RFC 1123): at most 253 characters, only lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character.", +} + +func (ConsoleAuthProxyTrustedCAConfigMapReference) SwaggerDoc() map[string]string { + return map_ConsoleAuthProxyTrustedCAConfigMapReference +} + var map_ConsoleConfigRoute = map[string]string{ "": "ConsoleConfigRoute holds information on external route access to console. DEPRECATED", "hostname": "hostname is the desired custom domain under which console will be available.", @@ -306,6 +327,16 @@ func (ConsoleCustomization) SwaggerDoc() map[string]string { return map_ConsoleCustomization } +var map_ConsoleIngress = map[string]string{ + "": "Ingress allows cluster admin to configure alternative ingress for the console.", + "consoleURL": "consoleURL is a URL to be used as the base console address. If not specified, the console route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. Make sure that appropriate ingress is set up at this URL. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", + "clientDownloadsURL": "clientDownloadsURL is a URL to be used as the address to download client binaries. If not specified, the downloads route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", +} + +func (ConsoleIngress) SwaggerDoc() map[string]string { + return map_ConsoleIngress +} + var map_ConsoleList = map[string]string{ "": "Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", @@ -326,6 +357,7 @@ func (ConsoleProviders) SwaggerDoc() map[string]string { var map_ConsoleSpec = map[string]string{ "": "ConsoleSpec is the specification of the desired behavior of the Console.", + "authProxy": "authProxy configures proxy settings for outbound connections made by Console's OIDC login clients, including discovery, JWKS retrieval, code exchange, and token refresh. When set, it replaces the cluster-wide proxy (proxy.config.openshift.io/cluster) entirely for these connections; individual fields are not inherited from the cluster-wide configuration. At least one of httpProxy or httpsProxy must be specified. When omitted, the cluster-wide proxy is used if configured; otherwise no proxy is used. Other Console clients retain their existing proxy settings.", "customization": "customization is used to optionally provide a small set of customization options to the web console.", "providers": "providers contains configuration for using specific service providers.", "route": "route contains hostname and secret reference that contains the serving certificate. If a custom route is specified, a new route will be created with the provided hostname, under which console will be available. In case of custom hostname uses the default routing suffix of the cluster, the Secret specification for a serving certificate will not be needed. In case of custom hostname points to an arbitrary domain, manual DNS configurations steps are necessary. The default console route will be maintained to reserve the default hostname for console if the custom route is removed. If not specified, default route will be used. DEPRECATED", @@ -396,16 +428,6 @@ func (FileReferenceSource) SwaggerDoc() map[string]string { return map_FileReferenceSource } -var map_Ingress = map[string]string{ - "": "Ingress allows cluster admin to configure alternative ingress for the console.", - "consoleURL": "consoleURL is a URL to be used as the base console address. If not specified, the console route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. Make sure that appropriate ingress is set up at this URL. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", - "clientDownloadsURL": "clientDownloadsURL is a URL to be used as the address to download client binaries. If not specified, the downloads route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", -} - -func (Ingress) SwaggerDoc() map[string]string { - return map_Ingress -} - var map_Logo = map[string]string{ "": "Logo defines a configuration based on theme modes for the console UI logo.", "type": "type specifies the type of the logo for the console UI. It determines whether the logo is for the masthead or favicon. type is a required field that allows values of Masthead and Favicon. When set to \"Masthead\", the logo will be used in the masthead and about modal of the console UI. When set to \"Favicon\", the logo will be used as the favicon of the console UI.", @@ -895,6 +917,55 @@ func (EtcdSpec) SwaggerDoc() map[string]string { return map_EtcdSpec } +var map_GatewayAPIIngressConfig = map[string]string{ + "": "GatewayAPIIngressConfig holds configuration for Gateway API integration in the Cluster Ingress Operator.", + "managementMode": "managementMode specifies how the Cluster Ingress Operator manages Gateway API Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, and its Gateway API controllers.\n\nAllowed values are \"Managed\" and \"Unmanaged\".\n\nWhen omitted or set to \"Managed\", the ingress operator installs, owns, and upgrades the Gateway API CRDs, protects them with a Validating Admission Policy, and deploys the OpenShift Gateway API implementation and its Gateway API controllers.\n\nWhen set to \"Unmanaged\", the ingress operator does not install or manage Gateway API CRDs and does not deploy the OpenShift Gateway API implementation or its Gateway API controllers. The cluster administrator or a third-party product is responsible for providing their own CRDs and Gateway controller. The ingress operator reports observational status only.", +} + +func (GatewayAPIIngressConfig) SwaggerDoc() map[string]string { + return map_GatewayAPIIngressConfig +} + +var map_Ingress = map[string]string{ + "": "Ingress contains configuration options specific to the Ingress Operator itself, including how it manages Gateway API integration.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "spec": "spec holds user settable values for configuration.", + "status": "status holds observed values from the cluster.", +} + +func (Ingress) SwaggerDoc() map[string]string { + return map_Ingress +} + +var map_IngressList = map[string]string{ + "": "IngressList is a collection of Ingresses.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of Ingresses.", +} + +func (IngressList) SwaggerDoc() map[string]string { + return map_IngressList +} + +var map_IngressSpec = map[string]string{ + "": "IngressSpec is the specification of the desired behavior of the Ingress Operator.", + "gatewayAPI": "gatewayAPI holds configuration for Gateway API integration, including how the ingress operator manages Gateway API CRDs, the OpenShift Gateway API implementation, and its Gateway API controllers.", +} + +func (IngressSpec) SwaggerDoc() map[string]string { + return map_IngressSpec +} + +var map_IngressStatus = map[string]string{ + "": "IngressStatus defines the observed status of the Ingress Operator.", + "conditions": "conditions is a list of conditions and their status.\n\nGateway API CRD management conditions are reported here with the \"GatewayAPI\" prefix:\n\n* \"GatewayAPICRDsManaged\" indicates whether the ingress operator is actively\n managing Gateway API CRDs.\n* \"GatewayAPICRDsPresent\" indicates whether Gateway API CRDs exist on the\n cluster.\n* \"GatewayAPICRDsCompliant\" indicates whether the installed CRDs match the\n version expected by this ingress operator release.", + "observedGeneration": "observedGeneration represents the most recent generation observed by the operator and specifies the version of the spec field currently being synced.\n\nWhen omitted, the operator has not yet observed the resource.", +} + +func (IngressStatus) SwaggerDoc() map[string]string { + return map_IngressStatus +} + var map_AWSClassicLoadBalancerParameters = map[string]string{ "": "AWSClassicLoadBalancerParameters holds configuration parameters for an AWS Classic load balancer.", "connectionIdleTimeout": "connectionIdleTimeout specifies the maximum time period that a connection may be idle before the load balancer closes the connection. The value must be parseable as a time duration value; see . A nil or zero value means no opinion, in which case a default value is used. The default value for this field is 60s. This default is subject to change.", @@ -1174,7 +1245,7 @@ var map_IngressControllerSpec = map[string]string{ "httpCompression": "httpCompression defines a policy for HTTP traffic compression. By default, there is no HTTP compression.", "idleConnectionTerminationPolicy": "idleConnectionTerminationPolicy maps directly to HAProxy's idle-close-on-response option and controls whether HAProxy keeps idle frontend connections open during a soft stop (router reload).\n\nAllowed values for this field are \"Immediate\" and \"Deferred\". The default value is \"Immediate\".\n\nWhen set to \"Immediate\", idle connections are closed immediately during router reloads. This ensures immediate propagation of route changes but may impact clients sensitive to connection resets.\n\nWhen set to \"Deferred\", HAProxy will maintain idle connections during a soft reload instead of closing them immediately. These connections remain open until any of the following occurs:\n\n - A new request is received on the connection, in which\n case HAProxy handles it in the old process and closes\n the connection after sending the response.\n\n - HAProxy's `timeout http-keep-alive` duration expires.\n By default this is 300 seconds, but it can be changed\n using httpKeepAliveTimeout tuning option.\n\n - The client's keep-alive timeout expires, causing the\n client to close the connection.\n\nSetting Deferred can help prevent errors in clients or load balancers that do not properly handle connection resets. Additionally, this option allows you to retain the pre-2.4 HAProxy behaviour: in HAProxy version 2.2 (OpenShift versions < 4.14), maintaining idle connections during a soft reload was the default behaviour, but starting with HAProxy 2.4, the default changed to closing idle connections immediately.\n\nImportant Consideration:\n\n - Using Deferred will result in temporary inconsistencies\n for the first request on each persistent connection\n after a route update and router reload. This request\n will be processed by the old HAProxy process using its\n old configuration. Subsequent requests will use the\n updated configuration.\n\nOperational Considerations:\n\n - Keeping idle connections open during reloads may lead\n to an accumulation of old HAProxy processes if\n connections remain idle for extended periods,\n especially in environments where frequent reloads\n occur.\n\n - Consider monitoring the number of HAProxy processes in\n the router pods when Deferred is set.\n\n - You may need to enable or adjust the\n `ingress.operator.openshift.io/hard-stop-after`\n duration (configured via an annotation on the\n IngressController resource) in environments with\n frequent reloads to prevent resource exhaustion.", "closedClientConnectionPolicy": "closedClientConnectionPolicy controls how the IngressController behaves when the client closes the TCP connection while the TLS handshake or HTTP request is in progress. This option maps directly to HAProxy’s \"abortonclose\" option.\n\nValid values are: \"Abort\" and \"Continue\". The default value is \"Continue\".\n\nWhen set to \"Abort\", the router will stop processing the TLS handshake if it is in progress, and it will not send an HTTP request to the backend server if the request has not yet been sent when the client closes the connection.\n\nWhen set to \"Continue\", the router will complete the TLS handshake if it is in progress, or send an HTTP request to the backend server and wait for the backend server's response, regardless of whether the client has closed the connection.\n\nSetting \"Abort\" can help free CPU resources otherwise spent on TLS computation for connections the client has already closed, and can reduce request queue size, thereby reducing the load on saturated backend servers.\n\nImportant Considerations:\n\n - The default policy (\"Continue\") is HTTP-compliant, and requests\n for aborted client connections will still be served.\n Use the \"Continue\" policy to allow a client to send a request\n and then immediately close its side of the connection while\n still receiving a response on the half-closed connection.\n\n - When clients use keep-alive connections, the most common case for premature\n closure is when the user wants to cancel the transfer or when a timeout\n occurs. In that case, the \"Abort\" policy may be used to reduce resource consumption.\n\n - Using RSA keys larger than 2048 bits can significantly slow down\n TLS computations. Consider using the \"Abort\" policy to reduce CPU usage.", - "haproxyVersion": "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nOpenShift 5.0 introduces HAProxy 3.2 as its default version and supports HAProxy 2.8 from OpenShift 4.22 for migration purposes. When an OpenShift release introduces a new default HAProxy version, that HAProxy version becomes available as a pinnable value in subsequent OpenShift releases, providing a smooth migration path for administrators who want to defer HAProxy upgrades.\n\nValid values for OpenShift 5.0: - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.0) - \"3.2\": Explicitly pins HAProxy 3.2 for preservation during cluster\n upgrades to future OpenShift releases\n- \"2.8\": Uses HAProxy 2.8 from OpenShift 4.22 (migration support, will\n be dropped in the next OpenShift release)\n\nIf a specific HAProxy version is set and would become unsupported in a target cluster upgrade, a preflight check will block the cluster upgrade until this field is updated to unset or a supported version.", + "haproxyVersion": "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nOpenShift 5.1 uses HAProxy 3.2 as its default version and supports HAProxy 3.4 as an explicit, non-default opt-in.\n\nValid values for OpenShift 5.1: - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.1) - \"3.2\": Uses the latest HAProxy 3.2.z available for this OpenShift release and pins the minor version. - \"3.4\": Uses the latest HAProxy 3.4.z available for this OpenShift release. This is an explicit opt-in; HAProxy 3.4 is not the default.\n\nPlanned lifecycle for later OpenShift releases: - OpenShift 5.2 plans to make HAProxy 3.4 the default when this field is unset, while continuing to support \"3.2\" as an explicit selection. - OpenShift 5.3 plans to retire support for selecting HAProxy 3.2.\n\nNote: HAProxy 2.8 support has been dropped in OpenShift 5.1. Upgrading from OpenShift 5.0 with haproxyVersion set to \"2.8\" is blocked.\n\nIf a specific HAProxy version is set and would become unsupported in a target cluster upgrade, a preflight check will block the cluster upgrade until this field is updated to unset or a supported version.", } func (IngressControllerSpec) SwaggerDoc() map[string]string { @@ -1192,7 +1263,7 @@ var map_IngressControllerStatus = map[string]string{ "observedGeneration": "observedGeneration is the most recent generation observed.", "namespaceSelector": "namespaceSelector is the actual namespaceSelector in use.", "routeSelector": "routeSelector is the actual routeSelector in use.", - "effectiveHAProxyVersion": "effectiveHAProxyVersion reports the HAProxy version currently in use by this IngressController. This reflects the resolved value of the spec.haproxyVersion field. When omitted, the effective value has not yet been resolved by the operator or the feature is not enabled for this cluster.\n\nExamples for OpenShift 5.0: - \"3.2\": Using HAProxy 3.2 - \"2.8\": Using HAProxy 2.8", + "effectiveHAProxyVersion": "effectiveHAProxyVersion reports the HAProxy version currently in use by this IngressController. This reflects the resolved value of the spec.haproxyVersion field. When omitted, the effective value has not yet been resolved by the operator or the feature is not enabled for this cluster.\n\nExamples for OpenShift 5.1: - \"3.2\": Using the default HAProxy 3.2 - \"3.4\": Using the explicitly selected, non-default HAProxy 3.4\n\nPlanned lifecycle for later OpenShift releases: - OpenShift 5.2 plans to make HAProxy 3.4 the default while keeping HAProxy 3.2 selectable. - OpenShift 5.3 plans to retire HAProxy 3.2.", } func (IngressControllerStatus) SwaggerDoc() map[string]string { @@ -1426,7 +1497,7 @@ var map_KMSPreflightResult = map[string]string{ "": "KMSPreflightResult contains the outcome of a preflight validation.", "status": "status indicates the outcome of the preflight check. Succeeded means the KMS plugin responded to Status, Encrypt, and Decrypt calls successfully. Failed means the validation did not pass.", "configHash": "configHash is the hash of the configuration that was validated. This is compared against observedConfigHash to confirm the result corresponds to the current configuration. The value must be exactly 8 characters.", - "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. The value must be between 1 and 1024 characters.", + "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. When omitted, no remote key identifier is available. This is expected when status is Failed, for example when the KMS provider could not be reached. When status is Succeeded, remoteKeyID is required. When set, the value must be between 1 and 1024 characters.", } func (KMSPreflightResult) SwaggerDoc() map[string]string { @@ -1635,7 +1706,7 @@ func (MachineManager) SwaggerDoc() map[string]string { } var map_MachineManagerSelector = map[string]string{ - "mode": "mode determines how machine managers will be selected for updates. Valid values are All, Partial and None. All means that every resource matched by the machine manager will be updated. Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. None means that every resource matched by the machine manager will not be updated.", + "mode": "mode determines how machine managers will be selected for updates. Valid values are All, Partial and None. All means that every resource matched by the machine manager will be updated. Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. None means that every resource matched by the machine manager will not be updated. When boot image skew enforcement is in Automatic mode, only All is permitted for the machinesets and machinedeployments resource types, in any API group.", "partial": "partial provides label selector(s) that can be used to match machine management resources. Only permitted when mode is set to \"Partial\".", } diff --git a/api/vendor/modules.txt b/api/vendor/modules.txt index ee9e81cf3b25..7327a6441e76 100644 --- a/api/vendor/modules.txt +++ b/api/vendor/modules.txt @@ -13,7 +13,7 @@ github.com/modern-go/concurrent # github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee ## explicit; go 1.12 github.com/modern-go/reflect2 -# github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 +# github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c ## explicit; go 1.26.0 github.com/openshift/api/config/v1 github.com/openshift/api/operator/v1 diff --git a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.kms-encryption.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.kms-encryption.testsuite.yaml index d00718c14a27..17b0da696f7a 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.kms-encryption.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/hostedclusters.hypershift.openshift.io/featuregated.hostedclusters.kms-encryption.testsuite.yaml @@ -1,11 +1,72 @@ apiVersion: apiextensions.k8s.io/v1 -name: HostedCluster legacy KMS encryption compatibility +name: HostedCluster CustomNoUpgrade KMS contract transition crdName: hostedclusters.hypershift.openshift.io crdFeatureSet: CustomNoUpgrade version: v1beta1 tests: onCreate: - - name: When legacy inline Vault KMS configuration is provided, it should succeed + - name: When a valid KMS pluginConfig reference is provided, it should succeed and persist the reference + initial: &validPluginConfig | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: cluster + expected: *validPluginConfig + + - name: When legacy inline Vault KMS configuration is provided, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedCluster @@ -70,14 +131,33 @@ tests: secret: name: vault-credentials vaultKeyPath: transit/keys/test-key + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" - - name: When pluginConfig-only KMS configuration is provided to the legacy schema, it should fail instead of being silently pruned + - name: When the legacy KMS provider type is provided without pluginConfig, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedCluster spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management platform: type: None pullSecret: @@ -108,14 +188,67 @@ tests: encryption: type: KMS kms: - pluginConfig: - apiVersion: config.openshift.io/v1 - resource: vaultkmsconfigs - name: cluster - expectedError: "spec.configuration.apiServer.encryption.kms.type: Required value" + type: Vault + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" - onUpdate: - - name: When legacy inline Vault KMS configuration is unchanged, it should allow an unrelated channel update + - name: When KMS pluginConfig is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is empty, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedCluster @@ -170,22 +303,15 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key - updated: | + pluginConfig: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig is not an object, it should be rejected + initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedCluster spec: capabilities: {} - channel: stable-4.22 controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com @@ -235,22 +361,15 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key - expected: | + pluginConfig: invalid + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig in body must be of type object" + + - name: When KMS pluginConfig apiVersion is missing, it should be rejected + initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedCluster spec: capabilities: {} - channel: stable-4.22 controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com @@ -300,13 +419,1108 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key + pluginConfig: + resource: vaultkmsconfigs + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig resource is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.resource: Required value" + + - name: When KMS pluginConfig name is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.name: Required value" + + - name: When KMS pluginConfig apiVersion is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: v1 + resource: vaultkmsconfigs + name: cluster + expectedError: "apiVersion must be in the format /" + + - name: When KMS pluginConfig resource is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: VaultKMSConfig + name: cluster + expectedError: "resource must be a valid Kubernetes resource name" + + - name: When KMS pluginConfig name is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: Invalid_Name + expectedError: "name must be a valid DNS subdomain name" + + onUpdate: + - name: When a valid KMS pluginConfig reference is updated, it should succeed and persist the new reference + initial: *validPluginConfig + updated: &updatedPluginConfig | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: replacement + expected: *updatedPluginConfig + + - name: When KMS pluginConfig is unchanged, it should allow an unrelated spec update + initial: *validPluginConfig + updated: &unrelatedUpdate | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + channel: stable-4.22 + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: cluster + expected: *unrelatedUpdate + + - name: When legacy inline Vault KMS configuration is provided on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-credentials + vaultKeyPath: transit/keys/test-key + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When the legacy KMS provider type is provided without pluginConfig on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + type: Vault + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is empty on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig is not an object on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: invalid + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig in body must be of type object" + + - name: When KMS pluginConfig apiVersion is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + resource: vaultkmsconfigs + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig resource is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.resource: Required value" + + - name: When KMS pluginConfig name is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.name: Required value" + + - name: When KMS pluginConfig apiVersion is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: v1 + resource: vaultkmsconfigs + name: cluster + expectedError: "apiVersion must be in the format /" + + - name: When KMS pluginConfig resource is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: VaultKMSConfig + name: cluster + expectedError: "resource must be a valid Kubernetes resource name" + + - name: When KMS pluginConfig name is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedCluster + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + networking: + networkType: OVNKubernetes + clusterNetwork: + - cidr: 10.132.0.0/14 + serviceNetwork: + - cidr: 172.31.0.0/16 + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + release: + image: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: Invalid_Name + expectedError: "name must be a valid DNS subdomain name" diff --git a/cmd/install/assets/crds/hypershift-operator/tests/hostedcontrolplanes.hypershift.openshift.io/featuregated.hostedcontrolplanes.kms-encryption.testsuite.yaml b/cmd/install/assets/crds/hypershift-operator/tests/hostedcontrolplanes.hypershift.openshift.io/featuregated.hostedcontrolplanes.kms-encryption.testsuite.yaml index 69dbfdc05bd0..dd5948cab460 100644 --- a/cmd/install/assets/crds/hypershift-operator/tests/hostedcontrolplanes.hypershift.openshift.io/featuregated.hostedcontrolplanes.kms-encryption.testsuite.yaml +++ b/cmd/install/assets/crds/hypershift-operator/tests/hostedcontrolplanes.hypershift.openshift.io/featuregated.hostedcontrolplanes.kms-encryption.testsuite.yaml @@ -1,11 +1,68 @@ apiVersion: apiextensions.k8s.io/v1 -name: HostedControlPlane legacy KMS encryption compatibility +name: HostedControlPlane CustomNoUpgrade KMS contract transition crdName: hostedcontrolplanes.hypershift.openshift.io crdFeatureSet: CustomNoUpgrade version: v1beta1 tests: onCreate: - - name: When legacy inline Vault KMS configuration is provided, it should succeed + - name: When a valid KMS pluginConfig reference is provided, it should succeed and persist the reference + initial: &validPluginConfig | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: cluster + expected: *validPluginConfig + + - name: When legacy inline Vault KMS configuration is provided, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedControlPlane @@ -66,18 +123,28 @@ tests: secret: name: vault-credentials vaultKeyPath: transit/keys/test-key + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" - - name: When pluginConfig-only KMS configuration is provided to the legacy schema, it should fail instead of being silently pruned + - name: When the legacy KMS provider type is provided without pluginConfig, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedControlPlane spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com etcd: managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi infraID: example + infrastructureAvailabilityPolicy: SingleReplica issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management platform: type: None pullSecret: @@ -109,14 +176,63 @@ tests: encryption: type: KMS kms: - pluginConfig: - apiVersion: config.openshift.io/v1 - resource: vaultkmsconfigs - name: cluster - expectedError: "spec.configuration.apiServer.encryption.kms.type: Required value" + type: Vault + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" - onUpdate: - - name: When legacy inline Vault KMS configuration is unchanged, it should allow an unrelated channel update + - name: When KMS pluginConfig is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is empty, it should be rejected initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedControlPlane @@ -167,22 +283,15 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key - updated: | + pluginConfig: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig is not an object, it should be rejected + initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedControlPlane spec: capabilities: {} - channel: stable-4.22 controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com @@ -228,22 +337,15 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key - expected: | + pluginConfig: invalid + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig in body must be of type object" + + - name: When KMS pluginConfig apiVersion is missing, it should be rejected + initial: | apiVersion: hypershift.openshift.io/v1beta1 kind: HostedControlPlane spec: capabilities: {} - channel: stable-4.22 controllerAvailabilityPolicy: HighlyAvailable dns: baseDomain: example.com @@ -289,13 +391,1036 @@ tests: encryption: type: KMS kms: - type: Vault - vault: - kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-credentials - vaultKeyPath: transit/keys/test-key + pluginConfig: + resource: vaultkmsconfigs + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig resource is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.resource: Required value" + + - name: When KMS pluginConfig name is missing, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.name: Required value" + + - name: When KMS pluginConfig apiVersion is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: v1 + resource: vaultkmsconfigs + name: cluster + expectedError: "apiVersion must be in the format /" + + - name: When KMS pluginConfig resource is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: VaultKMSConfig + name: cluster + expectedError: "resource must be a valid Kubernetes resource name" + + - name: When KMS pluginConfig name is invalid, it should be rejected + initial: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: Invalid_Name + expectedError: "name must be a valid DNS subdomain name" + + onUpdate: + - name: When a valid KMS pluginConfig reference is updated, it should succeed and persist the new reference + initial: *validPluginConfig + updated: &updatedPluginConfig | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: replacement + expected: *updatedPluginConfig + + - name: When KMS pluginConfig is unchanged, it should allow an unrelated spec update + initial: *validPluginConfig + updated: &unrelatedUpdate | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + fips: true + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: cluster + expected: *unrelatedUpdate + + - name: When legacy inline Vault KMS configuration is provided on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: quay.io/hashicorp/vault-k8s@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-credentials + vaultKeyPath: transit/keys/test-key + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When the legacy KMS provider type is provided without pluginConfig on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + type: Vault + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig: Required value" + + - name: When KMS pluginConfig is empty on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: {} + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig is not an object on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: invalid + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig in body must be of type object" + + - name: When KMS pluginConfig apiVersion is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + resource: vaultkmsconfigs + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.apiVersion: Required value" + + - name: When KMS pluginConfig resource is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + name: cluster + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.resource: Required value" + + - name: When KMS pluginConfig name is missing on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + expectedError: "spec.configuration.apiServer.encryption.kms.pluginConfig.name: Required value" + + - name: When KMS pluginConfig apiVersion is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: v1 + resource: vaultkmsconfigs + name: cluster + expectedError: "apiVersion must be in the format /" + + - name: When KMS pluginConfig resource is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: VaultKMSConfig + name: cluster + expectedError: "resource must be a valid Kubernetes resource name" + + - name: When KMS pluginConfig name is invalid on update, it should be rejected + initial: *validPluginConfig + updated: | + apiVersion: hypershift.openshift.io/v1beta1 + kind: HostedControlPlane + spec: + capabilities: {} + controllerAvailabilityPolicy: HighlyAvailable + dns: + baseDomain: example.com + etcd: + managementType: Managed + managed: + storage: + type: PersistentVolume + persistentVolume: + size: 8Gi + infraID: example + infrastructureAvailabilityPolicy: SingleReplica + issuerURL: https://kubernetes.default.svc + olmCatalogPlacement: management + platform: + type: None + pullSecret: + name: pull-secret + releaseImage: quay.io/openshift-release-dev/ocp-release:4.22.0-x86_64 + sshKey: + name: ssh-key + services: + - service: APIServer + servicePublishingStrategy: + type: Route + route: {} + - service: OAuthServer + servicePublishingStrategy: + type: Route + route: {} + - service: Konnectivity + servicePublishingStrategy: + type: Route + route: {} + - service: Ignition + servicePublishingStrategy: + type: Route + route: {} + configuration: + apiServer: + audit: + profile: Default + encryption: + type: KMS + kms: + pluginConfig: + apiVersion: config.openshift.io/v1 + resource: vaultkmsconfigs + name: Invalid_Name + expectedError: "name must be a valid DNS subdomain name" diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml index f22efa3043c1..7f3713fda07c 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml @@ -710,298 +710,64 @@ spec: managing the lifecyle of the encryption keys outside of the control plane. This allows integration with an external provider to manage the data encryption keys securely. properties: - type: + pluginConfig: description: |- - type defines the kind of platform for the KMS provider. - Allowed values are Vault. - When set to Vault, the plugin connects to a HashiCorp Vault server for key management. - enum: - - Vault - type: string - vault: - description: |- - vault defines the configuration for the Vault KMS plugin. - The plugin connects to a Vault Enterprise server that is managed - by the user outside the purview of the control plane. - This field must be set when type is Vault, and must be unset otherwise. + pluginConfig is a required reference to a cluster-scoped resource with a status subresource + that satisfies the OpenShift KMS plugin configuration status interface. properties: - authentication: - description: authentication defines the authentication - method used to authenticate with Vault. - properties: - appRole: - description: |- - appRole defines the configuration for AppRole authentication. - This field must be set when type is AppRole, and must be unset otherwise. - properties: - secret: - description: |- - secret references a secret in the openshift-config namespace containing - the AppRole credentials used to authenticate with Vault. - The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID. - properties: - name: - description: |- - name is the metadata.name of the referenced secret in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS - subdomain name: contain no more - than 253 characters, contain only - lowercase alphanumeric characters, - ''-'' or ''.'', and start and - end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - required: - - secret - type: object - type: - description: |- - type defines the authentication method used to authenticate with Vault. - Allowed values are AppRole. - When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault. - enum: - - AppRole - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: appRole config is required when authentication - type is AppRole, and forbidden otherwise - rule: 'self.type == ''AppRole'' ? has(self.appRole) - : !has(self.appRole)' - kmsPluginImage: + apiVersion: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with - a valid '@sha256:' suffix, where '' - is 64 characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the - host[:port][/namespace]/name format, resembling - a valid URL without the scheme. Short names - are not allowed, the registry hostname must - be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) - tls: - description: |- - tls contains the TLS configuration for connecting to the Vault server. - When this field is not set, system default TLS settings are used. - minProperties: 1 - properties: - caBundle: - description: |- - caBundle references a ConfigMap in the openshift-config namespace containing - the CA certificate bundle used to verify the TLS connection to the Vault server. - The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt". - When this field is not set, the system's trusted CA certificates are used. - - The namespace for the ConfigMap is openshift-config. - - Example ConfigMap: - apiVersion: v1 - kind: ConfigMap - metadata: - name: vault-ca-bundle - namespace: openshift-config - data: - ca-bundle.crt: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - properties: - name: - description: |- - name is the metadata.name of the referenced ConfigMap in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS subdomain - name: contain no more than 253 characters, - contain only lowercase alphanumeric - characters, ''-'' or ''.'', and start - and end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - serverName: - description: |- - serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS. - This is useful when the Vault server's hostname doesn't match its TLS certificate. - When this field is not set, the hostname from vaultAddress is used for SNI. - - The value must be a valid DNS hostname: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'serverName must be a valid DNS - hostname: contain no more than 253 characters, - contain only lowercase alphanumeric characters, - ''-'' or ''.'', and start and end with - an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - type: object - vaultAddress: - description: |- - vaultAddress specifies the address of the HashiCorp Vault instance. - The value must be a valid HTTPS URL containing only scheme, host, and optional port. - Paths, user info, query parameters, and fragments are not allowed. - - Format: https://hostname[:port] - Example: https://vault.example.com:8200 - - The value must be between 1 and 512 characters. - maxLength: 512 + apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + The value must be in the format /, where group is a DNS subdomain + and version is a Kubernetes API version (for example, v1 or v1alpha1). + It must contain between 1 and 64 characters. + maxLength: 64 minLength: 1 type: string x-kubernetes-validations: - - message: must be a valid URL - rule: isURL(self) - - message: must use the 'https' scheme - rule: isURL(self) && url(self).getScheme() == - 'https' - - message: must not contain a path - rule: isURL(self) && (url(self).getEscapedPath() - == '' || url(self).getEscapedPath() == '/') - - message: must not have a query - rule: isURL(self) && url(self).getQuery() == - {} - - message: must not have a fragment - rule: self.find('#(.+)$') == '' - - message: must not have user info - rule: self.find('@') == '' - vaultAuthNamespace: + - message: apiVersion must be in the format / + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$') + name: description: |- - vaultAuthNamespace specifies the Vault namespace to use for authentication. - This is only applicable for Vault Enterprise installations where authentication - and Transit operations may be in different namespaces. - When this field is not set, the value of vaultNamespace is used for both - authentication and Transit key operations. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + name is required and is the metadata.name of the referenced KMS plugin configuration resource. + The referenced resource must be cluster-scoped. + The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + maxLength: 253 minLength: 1 type: string x-kubernetes-validations: - - message: vaultAuthNamespace cannot end with - a forward slash - rule: '!self.endsWith(''/'')' - - message: vaultAuthNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultAuthNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' - vaultKeyPath: - description: |- - vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, - combining the Transit engine mount path and the key name separated by "/keys/". - Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). - - The total path length must be between 8 and 1542 characters. - The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) - and forward slashes as path separators, and must not contain "." or ".." path segments. - The key name must start and end with an alphanumeric character or underscore, and may contain - alphanumeric characters, underscores, hyphens, and periods in the middle. - maxLength: 1542 - minLength: 8 - type: string - x-kubernetes-validations: - - message: vaultKeyPath cannot start with a forward - slash - rule: '!self.startsWith(''/'')' - - message: vaultKeyPath cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultKeyPath cannot contain consecutive - forward slashes - rule: '!self.contains(''//'')' - - message: vaultKeyPath must only contain RFC - 3986 unreserved characters (alphanumeric, - hyphen, period, underscore, tilde) and forward - slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') - - message: vaultKeyPath must not contain '.' or - '..' path segments - rule: self.split('/').filter(s, s == '.' || - s == '..').size() == 0 - - message: vaultKeyPath must follow the format - /keys/ where the key name - starts and ends with an alphanumeric character - or underscore and may contain alphanumeric - characters, underscores, hyphens, and periods - rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') - vaultNamespace: + - message: 'name must be a valid DNS subdomain + name: contain no more than 253 characters, + contain only lowercase alphanumeric characters, + ''-'' or ''.'', and start and end with an + alphanumeric character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') + resource: description: |- - vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. - This is only applicable for Vault Enterprise installations. - When this field is not set, no namespace is used. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + not the Kind (for example, VaultKMSConfig). + The value must be between 1 and 63 characters, contain only lowercase alphanumeric + characters or '-', and start and end with an alphanumeric character. + maxLength: 63 minLength: 1 type: string x-kubernetes-validations: - - message: vaultNamespace cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' + - message: 'resource must be a valid Kubernetes + resource name: contain no more than 63 characters, + contain only lowercase alphanumeric characters + or ''-'', and start and end with an alphanumeric + character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?$') required: - - authentication - - kmsPluginImage - - vaultAddress - - vaultKeyPath + - apiVersion + - name + - resource type: object required: - - type + - pluginConfig type: object - x-kubernetes-validations: - - message: vault config is required when kms provider - type is Vault, and forbidden otherwise - rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)' type: description: |- type defines what encryption type should be used to encrypt resources at the datastore layer. diff --git a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml index 80d16ebb036c..34e55eb8dcde 100644 --- a/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml +++ b/cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/hostedcontrolplanes-Hypershift-CustomNoUpgrade.crd.yaml @@ -657,298 +657,64 @@ spec: managing the lifecyle of the encryption keys outside of the control plane. This allows integration with an external provider to manage the data encryption keys securely. properties: - type: + pluginConfig: description: |- - type defines the kind of platform for the KMS provider. - Allowed values are Vault. - When set to Vault, the plugin connects to a HashiCorp Vault server for key management. - enum: - - Vault - type: string - vault: - description: |- - vault defines the configuration for the Vault KMS plugin. - The plugin connects to a Vault Enterprise server that is managed - by the user outside the purview of the control plane. - This field must be set when type is Vault, and must be unset otherwise. + pluginConfig is a required reference to a cluster-scoped resource with a status subresource + that satisfies the OpenShift KMS plugin configuration status interface. properties: - authentication: - description: authentication defines the authentication - method used to authenticate with Vault. - properties: - appRole: - description: |- - appRole defines the configuration for AppRole authentication. - This field must be set when type is AppRole, and must be unset otherwise. - properties: - secret: - description: |- - secret references a secret in the openshift-config namespace containing - the AppRole credentials used to authenticate with Vault. - The referenced Secret must contain two keys: "role-id" for the AppRole Role ID and "secret-id" for the AppRole Secret ID. - properties: - name: - description: |- - name is the metadata.name of the referenced secret in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS - subdomain name: contain no more - than 253 characters, contain only - lowercase alphanumeric characters, - ''-'' or ''.'', and start and - end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - required: - - secret - type: object - type: - description: |- - type defines the authentication method used to authenticate with Vault. - Allowed values are AppRole. - When set to AppRole, the plugin uses AppRole credentials to authenticate with Vault. - enum: - - AppRole - type: string - required: - - type - type: object - x-kubernetes-validations: - - message: appRole config is required when authentication - type is AppRole, and forbidden otherwise - rule: 'self.type == ''AppRole'' ? has(self.appRole) - : !has(self.appRole)' - kmsPluginImage: + apiVersion: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with - a valid '@sha256:' suffix, where '' - is 64 characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the - host[:port][/namespace]/name format, resembling - a valid URL without the scheme. Short names - are not allowed, the registry hostname must - be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) - tls: - description: |- - tls contains the TLS configuration for connecting to the Vault server. - When this field is not set, system default TLS settings are used. - minProperties: 1 - properties: - caBundle: - description: |- - caBundle references a ConfigMap in the openshift-config namespace containing - the CA certificate bundle used to verify the TLS connection to the Vault server. - The referenced ConfigMap must contain the CA bundle in the key "ca-bundle.crt". - When this field is not set, the system's trusted CA certificates are used. - - The namespace for the ConfigMap is openshift-config. - - Example ConfigMap: - apiVersion: v1 - kind: ConfigMap - metadata: - name: vault-ca-bundle - namespace: openshift-config - data: - ca-bundle.crt: | - -----BEGIN CERTIFICATE----- - ... - -----END CERTIFICATE----- - properties: - name: - description: |- - name is the metadata.name of the referenced ConfigMap in the openshift-config namespace. - The name must be a valid DNS subdomain name: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'name must be a valid DNS subdomain - name: contain no more than 253 characters, - contain only lowercase alphanumeric - characters, ''-'' or ''.'', and start - and end with an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - required: - - name - type: object - serverName: - description: |- - serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS. - This is useful when the Vault server's hostname doesn't match its TLS certificate. - When this field is not set, the hostname from vaultAddress is used for SNI. - - The value must be a valid DNS hostname: it must contain no more than 253 characters, - contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. - maxLength: 253 - minLength: 1 - type: string - x-kubernetes-validations: - - message: 'serverName must be a valid DNS - hostname: contain no more than 253 characters, - contain only lowercase alphanumeric characters, - ''-'' or ''.'', and start and end with - an alphanumeric character' - rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') - type: object - vaultAddress: - description: |- - vaultAddress specifies the address of the HashiCorp Vault instance. - The value must be a valid HTTPS URL containing only scheme, host, and optional port. - Paths, user info, query parameters, and fragments are not allowed. - - Format: https://hostname[:port] - Example: https://vault.example.com:8200 - - The value must be between 1 and 512 characters. - maxLength: 512 + apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + The value must be in the format /, where group is a DNS subdomain + and version is a Kubernetes API version (for example, v1 or v1alpha1). + It must contain between 1 and 64 characters. + maxLength: 64 minLength: 1 type: string x-kubernetes-validations: - - message: must be a valid URL - rule: isURL(self) - - message: must use the 'https' scheme - rule: isURL(self) && url(self).getScheme() == - 'https' - - message: must not contain a path - rule: isURL(self) && (url(self).getEscapedPath() - == '' || url(self).getEscapedPath() == '/') - - message: must not have a query - rule: isURL(self) && url(self).getQuery() == - {} - - message: must not have a fragment - rule: self.find('#(.+)$') == '' - - message: must not have user info - rule: self.find('@') == '' - vaultAuthNamespace: + - message: apiVersion must be in the format / + rule: self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$') + name: description: |- - vaultAuthNamespace specifies the Vault namespace to use for authentication. - This is only applicable for Vault Enterprise installations where authentication - and Transit operations may be in different namespaces. - When this field is not set, the value of vaultNamespace is used for both - authentication and Transit key operations. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + name is required and is the metadata.name of the referenced KMS plugin configuration resource. + The referenced resource must be cluster-scoped. + The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + maxLength: 253 minLength: 1 type: string x-kubernetes-validations: - - message: vaultAuthNamespace cannot end with - a forward slash - rule: '!self.endsWith(''/'')' - - message: vaultAuthNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultAuthNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' - vaultKeyPath: - description: |- - vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine, - combining the Transit engine mount path and the key name separated by "/keys/". - Format: /keys/ (e.g., transit/keys/my-key, myteam/transit/keys/production-key). - - The total path length must be between 8 and 1542 characters. - The path cannot start or end with a forward slash, cannot contain consecutive forward slashes, - must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) - and forward slashes as path separators, and must not contain "." or ".." path segments. - The key name must start and end with an alphanumeric character or underscore, and may contain - alphanumeric characters, underscores, hyphens, and periods in the middle. - maxLength: 1542 - minLength: 8 - type: string - x-kubernetes-validations: - - message: vaultKeyPath cannot start with a forward - slash - rule: '!self.startsWith(''/'')' - - message: vaultKeyPath cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultKeyPath cannot contain consecutive - forward slashes - rule: '!self.contains(''//'')' - - message: vaultKeyPath must only contain RFC - 3986 unreserved characters (alphanumeric, - hyphen, period, underscore, tilde) and forward - slashes - rule: self.matches('^[a-zA-Z0-9._~/-]+$') - - message: vaultKeyPath must not contain '.' or - '..' path segments - rule: self.split('/').filter(s, s == '.' || - s == '..').size() == 0 - - message: vaultKeyPath must follow the format - /keys/ where the key name - starts and ends with an alphanumeric character - or underscore and may contain alphanumeric - characters, underscores, hyphens, and periods - rule: self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$') - vaultNamespace: + - message: 'name must be a valid DNS subdomain + name: contain no more than 253 characters, + contain only lowercase alphanumeric characters, + ''-'' or ''.'', and start and end with an + alphanumeric character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9\\-]*[a-z0-9])?)*$') + resource: description: |- - vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. - This is only applicable for Vault Enterprise installations. - When this field is not set, no namespace is used. - - The value must be between 1 and 4096 characters. - The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity. - maxLength: 4096 + resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + not the Kind (for example, VaultKMSConfig). + The value must be between 1 and 63 characters, contain only lowercase alphanumeric + characters or '-', and start and end with an alphanumeric character. + maxLength: 63 minLength: 1 type: string x-kubernetes-validations: - - message: vaultNamespace cannot end with a forward - slash - rule: '!self.endsWith(''/'')' - - message: vaultNamespace cannot contain spaces - rule: '!self.contains('' '')' - - message: vaultNamespace cannot be a reserved - string (root, sys, audit, auth, cubbyhole, - identity) - rule: '!(self in [''root'', ''sys'', ''audit'', - ''auth'', ''cubbyhole'', ''identity''])' + - message: 'resource must be a valid Kubernetes + resource name: contain no more than 63 characters, + contain only lowercase alphanumeric characters + or ''-'', and start and end with an alphanumeric + character' + rule: self.matches('^[a-z0-9]([a-z0-9\\-]*[a-z0-9])?$') required: - - authentication - - kmsPluginImage - - vaultAddress - - vaultKeyPath + - apiVersion + - name + - resource type: object required: - - type + - pluginConfig type: object - x-kubernetes-validations: - - message: vault config is required when kms provider - type is Vault, and forbidden otherwise - rule: 'self.type == ''Vault'' ? has(self.vault) : !has(self.vault)' type: description: |- type defines what encryption type should be used to encrypt resources at the datastore layer. diff --git a/go.mod b/go.mod index cf03e076c548..96774c806dc5 100644 --- a/go.mod +++ b/go.mod @@ -63,8 +63,8 @@ require ( github.com/onsi/gomega v1.42.1 github.com/opencontainers/go-digest v1.0.0 github.com/opencontainers/image-spec v1.1.1 - github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 - github.com/openshift/client-go v0.0.0-20261001003915-dcaad1dc7fe8 + github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c + github.com/openshift/client-go v0.0.0-20261026141621-1f34fe8dc069 github.com/openshift/cloud-credential-operator v0.0.0-20250225003505-216fd1a30ec3 github.com/openshift/cluster-api-provider-agent/api v0.0.0-20260120122324-898e638ec7d1 github.com/openshift/cluster-autoscaler-operator v0.0.1-0.20241204142113-43631b045675 @@ -309,9 +309,6 @@ require ( sigs.k8s.io/randfill v1.0.0 // indirect ) -// Prevent root-only client and library dependencies from raising the selected API compatibility pin. -exclude github.com/openshift/api v0.0.0-20260930220732-5588d747a72b - replace github.com/openshift/hypershift/api => ./api // Use our openshift version of karpenter instead of upstream diff --git a/go.sum b/go.sum index c100f2f9372e..eed51c551452 100644 --- a/go.sum +++ b/go.sum @@ -584,12 +584,12 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84= github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s= -github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 h1:/sDj4rzzTkN8i3Vug/+PxIjp1duKft9GdnhK5hb/yRk= -github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M= +github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c h1:htIaa9XrrcLWrDZIhIbSHA3GBjRbirC+0BVwHRhPrFI= +github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c/go.mod h1:2oI3aXQFDjjl7l4xA9ZPSkB+l+lyfWLg7P2sWg9yEvM= github.com/openshift/aws-karpenter-provider-aws v0.0.0-20260722223016-abcf7d1e3417 h1:b4vLxDvDmwESkz21ezCxIZOLRE8zk68gDjn4P4gvtbo= github.com/openshift/aws-karpenter-provider-aws v0.0.0-20260722223016-abcf7d1e3417/go.mod h1:K2x7H8k8k07WechkBHQ+sOr+6gPAkwILzVc7hYzODfY= -github.com/openshift/client-go v0.0.0-20261001003915-dcaad1dc7fe8 h1:yHA+77VmVlO0aBdZLmocC3EBYNza0B+Hwu+8hmkjj2k= -github.com/openshift/client-go v0.0.0-20261001003915-dcaad1dc7fe8/go.mod h1:VVl1SGimADe2vlYahxxxI87JOom7MPAiZqIDDhkedBU= +github.com/openshift/client-go v0.0.0-20261026141621-1f34fe8dc069 h1:vo9ZhSR8VBNz2NkkI3ZCCAIW4kAedAN/aDW4WAQAcBY= +github.com/openshift/client-go v0.0.0-20261026141621-1f34fe8dc069/go.mod h1:RV0r6eBQ57WE9EyuY9rMmAYm0YtohgZNDb2fJ0TPyaU= github.com/openshift/cloud-credential-operator v0.0.0-20250225003505-216fd1a30ec3 h1:cr5nU1+O8sEvZHpAAk1mTTGu3NMbgj0dC2cFxFjwmzw= github.com/openshift/cloud-credential-operator v0.0.0-20250225003505-216fd1a30ec3/go.mod h1:WHi2cToOBZyHQea0Yq3qVnOQRl6OMTGBPJMi0c4/GS8= github.com/openshift/cluster-autoscaler-operator v0.0.1-0.20241204142113-43631b045675 h1:hPFyXtaR42wqKKGMVP4G7M2vmp5iBxBqKetMguh4Td0= diff --git a/hack/tools/crd-schema-check/README.md b/hack/tools/crd-schema-check/README.md new file mode 100644 index 000000000000..94ae8b076d41 --- /dev/null +++ b/hack/tools/crd-schema-check/README.md @@ -0,0 +1,65 @@ +# CRD schema compatibility checks + +`make verify-crd-schema` compares installed CRDs with `PULL_BASE_SHA` using +crdify and `crdify-config.yaml`. Required-field changes remain errors by +default. Existing warning policies are unchanged. This local tool is also +part of aggregate verification; its diagnostic text does not establish the +existence of a separately overridable Prow job. + +## Acknowledged CustomNoUpgrade KMS transition + +The openshift/api revision `9af1f7b4730c7e2d452d3833b016cc639373d8d5` +changes the opt-in `KMSEncryption` configuration contract from inline +`type`/`vault` to a `pluginConfig` reference. This bump intentionally accepts +that contract change; it does **not** implement conversion of existing inline +Vault configuration or promise migration, downgrade, or rollback compatibility. +Existing CustomNoUpgrade objects may need an explicit configuration transition +before adopting the new schema. + +The containing `encryption` object is not wholly feature-gated. The affected +field is `spec.configuration.apiServer.encryption.kms`, not the independent +cloud-provider `spec.secretEncryption` API. Default and TechPreviewNoUpgrade +HC/HCP schemas do not contain the embedded `kms` field or the `KMS` encryption +type, and remain unchanged. This does not imply that CustomNoUpgrade has no users. + +`acknowledgeKMSTransition` runs **after** the ordinary comparison, before +diagnostic formatting. It treats exactly one required-field diagnostic as an +explicitly acknowledged warning only when all these identities match: + +- CRD `hostedclusters.hypershift.openshift.io` or + `hostedcontrolplanes.hypershift.openshift.io`, with matching group, + resource plural, kind and namespaced scope in both old and new CRDs; +- the exact corresponding + `cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/` + `-Hypershift-CustomNoUpgrade.crd.yaml` asset; +- `release.openshift.io/feature-set: CustomNoUpgrade` in both CRDs; +- schema and same-version comparison `v1beta1`, property + `^.spec.configuration.apiServer.encryption.kms`, comparator `required`, and + the sole error `new required fields: [pluginConfig]`; +- exact old/new KMS subtree SHA-256 fingerprints, computed from JSON-marshaled + Kubernetes `JSONSchemaProps`, including descriptions, nested constraints and + CEL. The old required set is `[type]`; the new set is `[pluginConfig]`. + +`testdata/kms-transition-0.json` is the old inline-Vault schema from base +`364a78f3d7001048a72e7c1c894c040bc7a43c04`; +`testdata/kms-transition-1.json` is the new pluginConfig schema generated from +the frozen API revision above. Tests verify their fingerprints. They are +reviewed snapshots, not an automatically refreshed allowlist: schema drift +must fail to match, not silently regenerate an exemption. + +The snapshots retain upstream description text, including the spelling +`lifecyle`. The repository's existing codespell word list includes that spelling +so spelling checks do not require changing the fingerprinted schemas. + +All other errors, all existing warnings, and served-version comparisons are +retained. No compared schema is mutated. A mismatched identity, subtree or +diagnostic receives no acknowledgment; the ordinary required-field error +still fails verification. Existing warning-class differences retain their +existing severity; this policy does not make every schema difference an error. + +Tests cover both exact transitions, identity/gate/path/version mismatches, +additional required fields, nested constraints, unrelated errors and warning +preservation. Admission and typed serialization tests separately document +new pluginConfig create/update/round-trip behavior and rejection of old inline +Vault configuration. An acknowledged checker warning is not evidence that +legacy objects remain compatible. diff --git a/hack/tools/crd-schema-check/kms_transition.go b/hack/tools/crd-schema-check/kms_transition.go new file mode 100644 index 000000000000..cfecb3b5042f --- /dev/null +++ b/hack/tools/crd-schema-check/kms_transition.go @@ -0,0 +1,99 @@ +package main + +import ( + "crypto/sha256" + "encoding/json" + "fmt" + + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" + "sigs.k8s.io/crdify/pkg/runner" + "sigs.k8s.io/crdify/pkg/validations" +) + +const ( + kmsTransitionPath = "^.spec.configuration.apiServer.encryption.kms" + kmsTransitionAssetDir = "cmd/install/assets/crds/hypershift-operator/zz_generated.crd-manifests/" + kmsTransitionOldFingerprint = "02491f43cf9a8e437cb201630b060fc4d0d8e5ef82bba1210a85ee79d59ad9e2" + kmsTransitionNewFingerprint = "5e25466217c01e1853c1300bf668a40b8783c8a6fda1a61128b503a26f85c142" + kmsTransitionError = "new required fields: [pluginConfig]" +) + +func acknowledgeKMSTransition(assetPath string, oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, results *runner.Results) { + if oldCRD == nil || newCRD == nil || results == nil { + return + } + var resource, kind string + switch newCRD.Name { + case "hostedclusters.hypershift.openshift.io": + resource, kind = "hostedclusters", "HostedCluster" + case "hostedcontrolplanes.hypershift.openshift.io": + resource, kind = "hostedcontrolplanes", "HostedControlPlane" + default: + return + } + if assetPath != kmsTransitionAssetDir+resource+"-Hypershift-CustomNoUpgrade.crd.yaml" { + return + } + for _, crd := range []*apiextensionsv1.CustomResourceDefinition{oldCRD, newCRD} { + if crd.Name != resource+".hypershift.openshift.io" || crd.Spec.Group != "hypershift.openshift.io" || + crd.Spec.Names.Plural != resource || crd.Spec.Names.Kind != kind || crd.Spec.Scope != apiextensionsv1.NamespaceScoped || + crd.Annotations["release.openshift.io/feature-set"] != "CustomNoUpgrade" { + return + } + } + if kmsTransitionFingerprint(oldCRD) != kmsTransitionOldFingerprint || kmsTransitionFingerprint(newCRD) != kmsTransitionNewFingerprint { + return + } + var matched *validations.ComparisonResult + for versionIndex := range results.SameVersionValidation { + versionResult := &results.SameVersionValidation[versionIndex] + if versionResult.Version != "v1beta1" { + continue + } + for propertyIndex := range versionResult.PropertyComparisons { + propertyResult := &versionResult.PropertyComparisons[propertyIndex] + if propertyResult.Property != kmsTransitionPath { + continue + } + for comparisonIndex := range propertyResult.ComparisonResults { + comparison := &propertyResult.ComparisonResults[comparisonIndex] + if comparison.Name != "required" { + continue + } + if matched != nil || len(comparison.Errors) != 1 || comparison.Errors[0] != kmsTransitionError { + return + } + matched = comparison + } + } + } + if matched != nil { + matched.Errors = nil + matched.Warnings = append(matched.Warnings, "acknowledged CustomNoUpgrade KMS contract transition (type -> pluginConfig; no migration or rollback compatibility): "+kmsTransitionError) + } +} + +func kmsTransitionFingerprint(crd *apiextensionsv1.CustomResourceDefinition) string { + if crd == nil { + return "" + } + for _, version := range crd.Spec.Versions { + if version.Name != "v1beta1" || !version.Served || !version.Storage || version.Schema == nil || version.Schema.OpenAPIV3Schema == nil { + continue + } + node := *version.Schema.OpenAPIV3Schema + for _, field := range []string{"spec", "configuration", "apiServer", "encryption", "kms"} { + var exists bool + node, exists = node.Properties[field] + if !exists { + return "" + } + } + data, err := json.Marshal(node) + if err != nil { + return "" + } + return fmt.Sprintf("%x", sha256.Sum256(data)) + } + return "" +} diff --git a/hack/tools/crd-schema-check/kms_transition_test.go b/hack/tools/crd-schema-check/kms_transition_test.go new file mode 100644 index 000000000000..357c089644ca --- /dev/null +++ b/hack/tools/crd-schema-check/kms_transition_test.go @@ -0,0 +1,272 @@ +package main + +import ( + "encoding/json" + "os" + "reflect" + "strings" + "testing" + + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "sigs.k8s.io/crdify/pkg/config" + "sigs.k8s.io/crdify/pkg/runner" + "sigs.k8s.io/crdify/pkg/validations" +) + +func transitionCRDs(t *testing.T, resource, kind string) (*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinition) { + t.Helper() + crds := make([]*apiextensionsv1.CustomResourceDefinition, 0, 2) + for _, fixture := range []string{"testdata/kms-transition-0.json", "testdata/kms-transition-1.json"} { + data, err := os.ReadFile(fixture) + if err != nil { + t.Fatal(err) + } + var node apiextensionsv1.JSONSchemaProps + if err := json.Unmarshal(data, &node); err != nil { + t.Fatal(err) + } + for _, field := range []string{"kms", "encryption", "apiServer", "configuration", "spec"} { + node = apiextensionsv1.JSONSchemaProps{Type: "object", Properties: map[string]apiextensionsv1.JSONSchemaProps{field: node}} + } + crds = append(crds, &apiextensionsv1.CustomResourceDefinition{ + ObjectMeta: metav1.ObjectMeta{Name: resource + ".hypershift.openshift.io", Annotations: map[string]string{"release.openshift.io/feature-set": "CustomNoUpgrade"}}, + Spec: apiextensionsv1.CustomResourceDefinitionSpec{ + Group: "hypershift.openshift.io", Scope: apiextensionsv1.NamespaceScoped, + Names: apiextensionsv1.CustomResourceDefinitionNames{Plural: resource, Kind: kind}, + Versions: []apiextensionsv1.CustomResourceDefinitionVersion{{Name: "v1beta1", Served: true, Storage: true, Schema: &apiextensionsv1.CustomResourceValidation{OpenAPIV3Schema: &node}}}, + }, + }) + } + return crds[0], crds[1] +} + +func transitionRunner(t *testing.T) *runner.Runner { + t.Helper() + cfg, err := config.Load("crdify-config.yaml") + if err != nil { + t.Fatal(err) + } + comparisonRunner, err := runner.New(cfg, runner.DefaultRegistry()) + if err != nil { + t.Fatal(err) + } + return comparisonRunner +} + +func transitionDiagnostics(results *runner.Results) ([]string, []string) { + var errors, warnings []string + for _, comparison := range results.CRDValidation { + errors = append(errors, comparison.Errors...) + warnings = append(warnings, comparison.Warnings...) + } + for _, version := range append(results.SameVersionValidation, results.ServedVersionValidation...) { + for _, property := range version.PropertyComparisons { + for _, comparison := range property.ComparisonResults { + errors = append(errors, comparison.Errors...) + warnings = append(warnings, comparison.Warnings...) + } + } + } + return errors, warnings +} + +func TestAcknowledgeKMSTransition(t *testing.T) { + t.Parallel() + t.Run("When schemas drift or unrelated validations fail, it should fail closed", testKMSTransitionSchemaControls) + t.Run("When inputs or comparisons are absent, it should leave results unchanged", func(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, "hostedclusters", "HostedCluster") + path := kmsTransitionAssetDir + "hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml" + acknowledgeKMSTransition(path, oldCRD, newCRD, nil) + results := &runner.Results{} + acknowledgeKMSTransition(path, nil, newCRD, results) + acknowledgeKMSTransition(path, oldCRD, nil, results) + acknowledgeKMSTransition(path, oldCRD, newCRD, results) + errors, warnings := transitionDiagnostics(results) + if len(errors) != 0 || len(warnings) != 0 { + t.Fatal("absent inputs produced diagnostics") + } + }) + for _, identity := range []struct{ resource, kind string }{{"hostedclusters", "HostedCluster"}, {"hostedcontrolplanes", "HostedControlPlane"}} { + t.Run("When "+identity.kind+" has the exact opt-in transition, it should acknowledge only its required error", func(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, identity.resource, identity.kind) + results := compareCRDs(oldCRD, newCRD, transitionRunner(t)) + errors, warnings := transitionDiagnostics(results) + if len(errors) != 1 || errors[0] != kmsTransitionError { + t.Fatalf("expected one real required error, got %v", errors) + } + beforeOld := oldCRD.DeepCopy() + beforeNew := newCRD.DeepCopy() + acknowledgeKMSTransition(kmsTransitionAssetDir+identity.resource+"-Hypershift-CustomNoUpgrade.crd.yaml", oldCRD, newCRD, results) + afterErrors, afterWarnings := transitionDiagnostics(results) + if len(afterErrors) != 0 || len(afterWarnings) != len(warnings)+1 { + t.Fatalf("expected only one acknowledged warning, got errors %v, warnings %v", afterErrors, afterWarnings) + } + for _, warning := range warnings { + if !strings.Contains(strings.Join(afterWarnings, "\n"), warning) { + t.Fatalf("lost warning %q", warning) + } + } + if !reflect.DeepEqual(beforeOld, oldCRD) || !reflect.DeepEqual(beforeNew, newCRD) { + t.Fatal("transition changed the compared schemas") + } + }) + } + tests := []struct { + name string + mutate func(*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinition, *string, *runner.Results) + }{ + {name: "When the CRD name differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Name = "nodepools.hypershift.openshift.io" + }}, + {name: "When the old CRD identity differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + oldCRD.Spec.Names.Kind = "HostedControlPlane" + }}, + {name: "When the API group differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Spec.Group = "other.openshift.io" + }}, + {name: "When the resource plural differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Spec.Names.Plural = "nodepools" + }}, + {name: "When the scope differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Spec.Scope = apiextensionsv1.ClusterScoped + }}, + {name: "When the asset path differs, it should retain the error", mutate: func(_, _ *apiextensionsv1.CustomResourceDefinition, path *string, _ *runner.Results) { + *path = "other/hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml" + }}, + {name: "When the gate is Default, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Annotations["release.openshift.io/feature-set"] = "Default" + }}, + {name: "When the old gate is missing, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + oldCRD.Annotations = nil + }}, + {name: "When the gate is TechPreviewNoUpgrade, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Annotations["release.openshift.io/feature-set"] = "TechPreviewNoUpgrade" + }}, + {name: "When the schema version differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Spec.Versions[0].Name = "v1alpha1" + }}, + {name: "When the storage version differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + newCRD.Spec.Versions[0].Storage = false + }}, + {name: "When the old schema differs, it should retain the error", mutate: func(oldCRD, newCRD *apiextensionsv1.CustomResourceDefinition, _ *string, _ *runner.Results) { + encryption := oldCRD.Spec.Versions[0].Schema.OpenAPIV3Schema.Properties["spec"].Properties["configuration"].Properties["apiServer"].Properties["encryption"] + kms := encryption.Properties["kms"] + kms.Required = nil + encryption.Properties["kms"] = kms + }}, + {name: "When the result version differs, it should retain the error", mutate: func(_, _ *apiextensionsv1.CustomResourceDefinition, _ *string, results *runner.Results) { + for index := range results.SameVersionValidation { + results.SameVersionValidation[index].Version = "v1alpha1" + } + }}, + {name: "When the result property differs, it should retain the error", mutate: func(_, _ *apiextensionsv1.CustomResourceDefinition, _ *string, results *runner.Results) { + for versionIndex := range results.SameVersionValidation { + for propertyIndex := range results.SameVersionValidation[versionIndex].PropertyComparisons { + results.SameVersionValidation[versionIndex].PropertyComparisons[propertyIndex].Property = "^.spec.secretEncryption.kms" + } + } + }}, + {name: "When there is an extra required diagnostic, it should retain every error", mutate: func(_, _ *apiextensionsv1.CustomResourceDefinition, _ *string, results *runner.Results) { + for versionIndex := range results.SameVersionValidation { + for propertyIndex := range results.SameVersionValidation[versionIndex].PropertyComparisons { + for comparisonIndex := range results.SameVersionValidation[versionIndex].PropertyComparisons[propertyIndex].ComparisonResults { + comparison := &results.SameVersionValidation[versionIndex].PropertyComparisons[propertyIndex].ComparisonResults[comparisonIndex] + if comparison.Name == "required" && len(comparison.Errors) > 0 { + comparison.Errors = append(comparison.Errors, "unexpected required error") + } + } + } + } + }}, + {name: "When only served versions report the change, it should retain the error", mutate: func(_, _ *apiextensionsv1.CustomResourceDefinition, _ *string, results *runner.Results) { + results.ServedVersionValidation, results.SameVersionValidation = results.SameVersionValidation, nil + }}, + } + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, "hostedclusters", "HostedCluster") + results := compareCRDs(oldCRD, newCRD, transitionRunner(t)) + path := kmsTransitionAssetDir + "hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml" + test.mutate(oldCRD, newCRD, &path, results) + before, err := json.Marshal(results) + if err != nil { + t.Fatal(err) + } + acknowledgeKMSTransition(path, oldCRD, newCRD, results) + after, err := json.Marshal(results) + if err != nil { + t.Fatal(err) + } + if string(before) != string(after) { + t.Fatal("nonmatching comparison results were changed") + } + }) + } +} + +func TestKMSTransitionFingerprint(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, "hostedclusters", "HostedCluster") + if kmsTransitionFingerprint(oldCRD) != kmsTransitionOldFingerprint || kmsTransitionFingerprint(newCRD) != kmsTransitionNewFingerprint { + t.Fatal("reviewed old/new schema fixtures do not match the pinned fingerprints") + } + if kmsTransitionFingerprint(nil) != "" { + t.Fatal("nil schema unexpectedly matched") + } + newCRD.Spec.Versions[0].Schema = nil + if kmsTransitionFingerprint(newCRD) != "" { + t.Fatal("missing schema unexpectedly matched") + } +} + +func testKMSTransitionSchemaControls(t *testing.T) { + t.Helper() + t.Parallel() + for _, test := range []struct { + name string + mutate func(*apiextensionsv1.JSONSchemaProps) + }{ + {name: "When another KMS field becomes required, it should fail closed", mutate: func(schema *apiextensionsv1.JSONSchemaProps) { + schema.Required = append(schema.Required, "anotherField") + }}, + {name: "When a nested constraint changes, it should fail closed", mutate: func(schema *apiextensionsv1.JSONSchemaProps) { + plugin := schema.Properties["pluginConfig"] + minimum := int64(2) + plugin.MinProperties = &minimum + schema.Properties["pluginConfig"] = plugin + }}, + {name: "When the reviewed description changes, it should fail closed", mutate: func(schema *apiextensionsv1.JSONSchemaProps) { schema.Description += " changed" }}, + } { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, "hostedclusters", "HostedCluster") + encryption := newCRD.Spec.Versions[0].Schema.OpenAPIV3Schema.Properties["spec"].Properties["configuration"].Properties["apiServer"].Properties["encryption"] + kms := encryption.Properties["kms"] + test.mutate(&kms) + encryption.Properties["kms"] = kms + results := compareCRDs(oldCRD, newCRD, transitionRunner(t)) + acknowledgeKMSTransition(kmsTransitionAssetDir+"hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml", oldCRD, newCRD, results) + errors, _ := transitionDiagnostics(results) + if len(errors) == 0 { + t.Fatal("schema drift unexpectedly received a waiver") + } + }) + } + t.Run("When unrelated required and scope changes accompany KMS, it should preserve those errors", func(t *testing.T) { + t.Parallel() + oldCRD, newCRD := transitionCRDs(t, "hostedclusters", "HostedCluster") + newCRD.Spec.Versions[0].Schema.OpenAPIV3Schema.Required = []string{"unrelated"} + results := compareCRDs(oldCRD, newCRD, transitionRunner(t)) + results.CRDValidation = append(results.CRDValidation, validations.ComparisonResult{Name: "scope", Errors: []string{"unrelated scope error"}, Warnings: []string{"existing warning"}}) + acknowledgeKMSTransition(kmsTransitionAssetDir+"hostedclusters-Hypershift-CustomNoUpgrade.crd.yaml", oldCRD, newCRD, results) + errors, warnings := transitionDiagnostics(results) + joined := strings.Join(errors, "\n") + if !strings.Contains(joined, "unrelated") || !strings.Contains(joined, "unrelated scope error") || len(errors) != 2 || !strings.Contains(strings.Join(warnings, "\n"), "existing warning") { + t.Fatalf("unrelated diagnostics lost: %v %v", errors, warnings) + } + }) +} diff --git a/hack/tools/crd-schema-check/main.go b/hack/tools/crd-schema-check/main.go index eeda40799061..ba2c4f198707 100644 --- a/hack/tools/crd-schema-check/main.go +++ b/hack/tools/crd-schema-check/main.go @@ -106,8 +106,7 @@ func run() error { for _, e := range allErrors { fmt.Fprintf(os.Stderr, " ERROR: %s\n", e) } - fmt.Fprintf(os.Stderr, "\nIf this is an intentional API change, see the crdify documentation for exception mechanisms.\n") - fmt.Fprintf(os.Stderr, "For pre-existing violations from moved/renamed files, use Prow: /override verify-crd-schema\n") + fmt.Fprintf(os.Stderr, "\nIntentional API changes require explicit review; see hack/tools/crd-schema-check/README.md.\n") return fmt.Errorf("breaking CRD schema changes detected") } @@ -197,6 +196,7 @@ func checkCRDsInDir(repoRoot, dir string, repo *gogit.Repository, baseHash *plum } compResults := compareCRDs(oldCRD, newCRD, crdifyRunner) + acknowledgeKMSTransition(relPath, oldCRD, newCRD, compResults) results.checked++ for _, cr := range compResults.CRDValidation { diff --git a/hack/tools/crd-schema-check/testdata/kms-transition-0.json b/hack/tools/crd-schema-check/testdata/kms-transition-0.json new file mode 100644 index 000000000000..16bf0fc7a4fb --- /dev/null +++ b/hack/tools/crd-schema-check/testdata/kms-transition-0.json @@ -0,0 +1,246 @@ +{ + "description": "kms defines the configuration for the external KMS instance that manages the encryption keys,\nwhen KMS encryption is enabled sensitive resources will be encrypted using keys managed by an\nexternally configured KMS instance.\n\nThe Key Management Service (KMS) instance provides symmetric encryption and is responsible for\nmanaging the lifecyle of the encryption keys outside of the control plane.\nThis allows integration with an external provider to manage the data encryption keys securely.", + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "description": "type defines the kind of platform for the KMS provider.\nAllowed values are Vault.\nWhen set to Vault, the plugin connects to a HashiCorp Vault server for key management.", + "type": "string", + "enum": [ + "Vault" + ] + }, + "vault": { + "description": "vault defines the configuration for the Vault KMS plugin.\nThe plugin connects to a Vault Enterprise server that is managed\nby the user outside the purview of the control plane.\nThis field must be set when type is Vault, and must be unset otherwise.", + "type": "object", + "required": [ + "authentication", + "kmsPluginImage", + "vaultAddress", + "vaultKeyPath" + ], + "properties": { + "authentication": { + "description": "authentication defines the authentication method used to authenticate with Vault.", + "type": "object", + "required": [ + "type" + ], + "properties": { + "appRole": { + "description": "appRole defines the configuration for AppRole authentication.\nThis field must be set when type is AppRole, and must be unset otherwise.", + "type": "object", + "required": [ + "secret" + ], + "properties": { + "secret": { + "description": "secret references a secret in the openshift-config namespace containing\nthe AppRole credentials used to authenticate with Vault.\nThe referenced Secret must contain two keys: \"role-id\" for the AppRole Role ID and \"secret-id\" for the AppRole Secret ID.", + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "description": "name is the metadata.name of the referenced secret in the openshift-config namespace.\nThe name must be a valid DNS subdomain name: it must contain no more than 253 characters,\ncontain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", + "type": "string", + "maxLength": 253, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')", + "message": "name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + } + ] + } + } + } + } + }, + "type": { + "description": "type defines the authentication method used to authenticate with Vault.\nAllowed values are AppRole.\nWhen set to AppRole, the plugin uses AppRole credentials to authenticate with Vault.", + "type": "string", + "enum": [ + "AppRole" + ] + } + }, + "x-kubernetes-validations": [ + { + "rule": "self.type == 'AppRole' ? has(self.appRole) : !has(self.appRole)", + "message": "appRole config is required when authentication type is AppRole, and forbidden otherwise" + } + ] + }, + "kmsPluginImage": { + "description": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest.\nThe format is: host[:port][/namespace]/name@sha256:\u003cdigest\u003e\nwhere the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9.\nThe total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed.\nThe registry hostname must be included and must contain at least one dot.\nImage tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version,\nthen obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry\nand reference the mirrored location with its digest.", + "type": "string", + "maxLength": 447, + "minLength": 75, + "x-kubernetes-validations": [ + { + "rule": "(self.split('@').size() == 2 \u0026\u0026 self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))", + "message": "the OCI Image reference must end with a valid '@sha256:\u003cdigest\u003e' suffix, where '\u003cdigest\u003e' is 64 characters long" + }, + { + "rule": "(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))", + "message": "the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme. Short names are not allowed, the registry hostname must be included." + } + ] + }, + "tls": { + "description": "tls contains the TLS configuration for connecting to the Vault server.\nWhen this field is not set, system default TLS settings are used.", + "type": "object", + "minProperties": 1, + "properties": { + "caBundle": { + "description": "caBundle references a ConfigMap in the openshift-config namespace containing\nthe CA certificate bundle used to verify the TLS connection to the Vault server.\nThe referenced ConfigMap must contain the CA bundle in the key \"ca-bundle.crt\".\nWhen this field is not set, the system's trusted CA certificates are used.\n\nThe namespace for the ConfigMap is openshift-config.\n\nExample ConfigMap:\n apiVersion: v1\n kind: ConfigMap\n metadata:\n name: vault-ca-bundle\n namespace: openshift-config\n data:\n ca-bundle.crt: |\n -----BEGIN CERTIFICATE-----\n ...\n -----END CERTIFICATE-----", + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "description": "name is the metadata.name of the referenced ConfigMap in the openshift-config namespace.\nThe name must be a valid DNS subdomain name: it must contain no more than 253 characters,\ncontain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", + "type": "string", + "maxLength": 253, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')", + "message": "name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + } + ] + } + } + }, + "serverName": { + "description": "serverName specifies the Server Name Indication (SNI) to use when connecting to Vault via TLS.\nThis is useful when the Vault server's hostname doesn't match its TLS certificate.\nWhen this field is not set, the hostname from vaultAddress is used for SNI.\n\nThe value must be a valid DNS hostname: it must contain no more than 253 characters,\ncontain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", + "type": "string", + "maxLength": 253, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')", + "message": "serverName must be a valid DNS hostname: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + } + ] + } + } + }, + "vaultAddress": { + "description": "vaultAddress specifies the address of the HashiCorp Vault instance.\nThe value must be a valid HTTPS URL containing only scheme, host, and optional port.\nPaths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port]\nExample: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", + "type": "string", + "maxLength": 512, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "isURL(self)", + "message": "must be a valid URL" + }, + { + "rule": "isURL(self) \u0026\u0026 url(self).getScheme() == 'https'", + "message": "must use the 'https' scheme" + }, + { + "rule": "isURL(self) \u0026\u0026 (url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/')", + "message": "must not contain a path" + }, + { + "rule": "isURL(self) \u0026\u0026 url(self).getQuery() == {}", + "message": "must not have a query" + }, + { + "rule": "self.find('#(.+)$') == ''", + "message": "must not have a fragment" + }, + { + "rule": "self.find('@') == ''", + "message": "must not have user info" + } + ] + }, + "vaultAuthNamespace": { + "description": "vaultAuthNamespace specifies the Vault namespace to use for authentication.\nThis is only applicable for Vault Enterprise installations where authentication\nand Transit operations may be in different namespaces.\nWhen this field is not set, the value of vaultNamespace is used for both\nauthentication and Transit key operations.\n\nThe value must be between 1 and 4096 characters.\nThe namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "type": "string", + "maxLength": 4096, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "!self.endsWith('/')", + "message": "vaultAuthNamespace cannot end with a forward slash" + }, + { + "rule": "!self.contains(' ')", + "message": "vaultAuthNamespace cannot contain spaces" + }, + { + "rule": "!(self in ['root', 'sys', 'audit', 'auth', 'cubbyhole', 'identity'])", + "message": "vaultAuthNamespace cannot be a reserved string (root, sys, audit, auth, cubbyhole, identity)" + } + ] + }, + "vaultKeyPath": { + "description": "vaultKeyPath specifies the full path to the encryption key in Vault's Transit secrets engine,\ncombining the Transit engine mount path and the key name separated by \"/keys/\".\nFormat: \u003cmount\u003e/keys/\u003ckey-name\u003e (e.g., transit/keys/my-key, myteam/transit/keys/production-key).\n\nThe total path length must be between 8 and 1542 characters.\nThe path cannot start or end with a forward slash, cannot contain consecutive forward slashes,\nmust only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde)\nand forward slashes as path separators, and must not contain \".\" or \"..\" path segments.\nThe key name must start and end with an alphanumeric character or underscore, and may contain\nalphanumeric characters, underscores, hyphens, and periods in the middle.", + "type": "string", + "maxLength": 1542, + "minLength": 8, + "x-kubernetes-validations": [ + { + "rule": "!self.startsWith('/')", + "message": "vaultKeyPath cannot start with a forward slash" + }, + { + "rule": "!self.endsWith('/')", + "message": "vaultKeyPath cannot end with a forward slash" + }, + { + "rule": "!self.contains('//')", + "message": "vaultKeyPath cannot contain consecutive forward slashes" + }, + { + "rule": "self.matches('^[a-zA-Z0-9._~/-]+$')", + "message": "vaultKeyPath must only contain RFC 3986 unreserved characters (alphanumeric, hyphen, period, underscore, tilde) and forward slashes" + }, + { + "rule": "self.split('/').filter(s, s == '.' || s == '..').size() == 0", + "message": "vaultKeyPath must not contain '.' or '..' path segments" + }, + { + "rule": "self.matches('^[a-zA-Z0-9._~-]+(/[a-zA-Z0-9._~-]+)*/keys/[a-zA-Z0-9_]([a-zA-Z0-9_.-]*[a-zA-Z0-9_])?$')", + "message": "vaultKeyPath must follow the format \u003cmount\u003e/keys/\u003ckey-name\u003e where the key name starts and ends with an alphanumeric character or underscore and may contain alphanumeric characters, underscores, hyphens, and periods" + } + ] + }, + "vaultNamespace": { + "description": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted.\nThis is only applicable for Vault Enterprise installations.\nWhen this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters.\nThe namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", + "type": "string", + "maxLength": 4096, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "!self.endsWith('/')", + "message": "vaultNamespace cannot end with a forward slash" + }, + { + "rule": "!self.contains(' ')", + "message": "vaultNamespace cannot contain spaces" + }, + { + "rule": "!(self in ['root', 'sys', 'audit', 'auth', 'cubbyhole', 'identity'])", + "message": "vaultNamespace cannot be a reserved string (root, sys, audit, auth, cubbyhole, identity)" + } + ] + } + } + } + }, + "x-kubernetes-validations": [ + { + "rule": "self.type == 'Vault' ? has(self.vault) : !has(self.vault)", + "message": "vault config is required when kms provider type is Vault, and forbidden otherwise" + } + ] +} diff --git a/hack/tools/crd-schema-check/testdata/kms-transition-1.json b/hack/tools/crd-schema-check/testdata/kms-transition-1.json new file mode 100644 index 000000000000..564581e1a5b3 --- /dev/null +++ b/hack/tools/crd-schema-check/testdata/kms-transition-1.json @@ -0,0 +1,56 @@ +{ + "description": "kms defines the configuration for the external KMS instance that manages the encryption keys,\nwhen KMS encryption is enabled sensitive resources will be encrypted using keys managed by an\nexternally configured KMS instance.\n\nThe Key Management Service (KMS) instance provides symmetric encryption and is responsible for\nmanaging the lifecyle of the encryption keys outside of the control plane.\nThis allows integration with an external provider to manage the data encryption keys securely.", + "type": "object", + "required": [ + "pluginConfig" + ], + "properties": { + "pluginConfig": { + "description": "pluginConfig is a required reference to a cluster-scoped resource with a status subresource\nthat satisfies the OpenShift KMS plugin configuration status interface.", + "type": "object", + "required": [ + "apiVersion", + "name", + "resource" + ], + "properties": { + "apiVersion": { + "description": "apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource.\nThe value must be in the format \u003cgroup\u003e/\u003cversion\u003e, where group is a DNS subdomain\nand version is a Kubernetes API version (for example, v1 or v1alpha1).\nIt must contain between 1 and 64 characters.", + "type": "string", + "maxLength": 64, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$')", + "message": "apiVersion must be in the format \u003cgroup\u003e/\u003cversion\u003e" + } + ] + }, + "name": { + "description": "name is required and is the metadata.name of the referenced KMS plugin configuration resource.\nThe referenced resource must be cluster-scoped.\nThe name must be a valid DNS subdomain name: it must contain between 1 and 253 characters,\ncontain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", + "type": "string", + "maxLength": 253, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')", + "message": "name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + } + ] + }, + "resource": { + "description": "resource is required and is the resource name of the referenced KMS plugin configuration custom resource.\nThis is the plural name used in the Kubernetes API (for example, vaultkmsconfigs),\nnot the Kind (for example, VaultKMSConfig).\nThe value must be between 1 and 63 characters, contain only lowercase alphanumeric\ncharacters or '-', and start and end with an alphanumeric character.", + "type": "string", + "maxLength": 63, + "minLength": 1, + "x-kubernetes-validations": [ + { + "rule": "self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?$')", + "message": "resource must be a valid Kubernetes resource name: contain no more than 63 characters, contain only lowercase alphanumeric characters or '-', and start and end with an alphanumeric character" + } + ] + } + } + } + } +} diff --git a/test/envtest/kms_featuregate_test.go b/test/envtest/kms_featuregate_test.go new file mode 100644 index 000000000000..c52fb30ddc80 --- /dev/null +++ b/test/envtest/kms_featuregate_test.go @@ -0,0 +1,69 @@ +//go:build envtest + +package envtest + +import ( + "encoding/json" + "fmt" + "testing" +) + +func TestAllCRDsForFeatureSet(t *testing.T) { + for _, featureSet := range []string{"Default", "TechPreviewNoUpgrade", "CustomNoUpgrade"} { + t.Run(fmt.Sprintf("When feature set is %s, it should expose KMS only in CustomNoUpgrade", featureSet), func(t *testing.T) { + found := map[string]bool{ + "hostedclusters.hypershift.openshift.io": false, + "hostedcontrolplanes.hypershift.openshift.io": false, + } + for _, crd := range allCRDsForFeatureSet(featureSet) { + if _, relevant := found[crd.Name]; !relevant { + continue + } + found[crd.Name] = true + if len(crd.Spec.Versions) == 0 { + t.Fatalf("%s has no schema versions", crd.Name) + } + for _, version := range crd.Spec.Versions { + t.Run(crd.Name+"/"+version.Name, func(t *testing.T) { + if version.Schema == nil || version.Schema.OpenAPIV3Schema == nil { + t.Fatal("CRD has no OpenAPI schema") + } + schema := *version.Schema.OpenAPIV3Schema + for _, field := range []string{"spec", "configuration", "apiServer", "encryption"} { + child, present := schema.Properties[field] + if !present { + t.Fatalf("missing parent schema field %s", field) + } + schema = child + } + _, hasKMS := schema.Properties["kms"] + wantKMS := featureSet == "CustomNoUpgrade" + if hasKMS != wantKMS { + t.Fatalf("kms schema present = %t, want %t", hasKMS, wantKMS) + } + typeSchema, present := schema.Properties["type"] + if !present || len(typeSchema.Enum) == 0 { + t.Fatal("encryption type must have an explicit enum") + } + hasKMSEnum := false + for _, value := range typeSchema.Enum { + var enum string + if err := json.Unmarshal(value.Raw, &enum); err != nil { + t.Fatalf("decode encryption type enum: %v", err) + } + hasKMSEnum = hasKMSEnum || enum == "KMS" + } + if hasKMSEnum != wantKMS { + t.Fatalf("KMS enum present = %t, want %t", hasKMSEnum, wantKMS) + } + }) + } + } + for name, present := range found { + if !present { + t.Errorf("installed feature set is missing %s", name) + } + } + }) + } +} diff --git a/vendor/github.com/openshift/api/.gitignore b/vendor/github.com/openshift/api/.gitignore index 1c3e4625d3bb..c396dc082818 100644 --- a/vendor/github.com/openshift/api/.gitignore +++ b/vendor/github.com/openshift/api/.gitignore @@ -19,3 +19,4 @@ tests/bin/ models-schema /render /write-available-featuresets +mise.toml diff --git a/vendor/github.com/openshift/api/.golangci.yaml b/vendor/github.com/openshift/api/.golangci.yaml index 1b8472410f52..a8e859f7acf7 100644 --- a/vendor/github.com/openshift/api/.golangci.yaml +++ b/vendor/github.com/openshift/api/.golangci.yaml @@ -110,6 +110,10 @@ linters: - kubeapilinter # osin/v1 types are config file APIs, not CRDs — validation is handled in Go code at config load time. path: osin/v1/types.go + - linters: + - kubeapilinter + # authentication/v1alpha1 types are config file APIs, not CRDs — validation is handled by oauth-apiserver at config load time. + path: authentication/v1alpha1/types_authentication_configuration.go - linters: - kubeapilinter # Silence norefs lint for `Ref` field in ClusterAPI as it refers to an OCI image reference, not a kube object reference. @@ -121,6 +125,23 @@ linters: # to enforce specific condition types are always present. path: etcd/v1/types_pacemakercluster.go text: "conditions: Conditions field in (PacemakerClusterStatus|PacemakerClusterNodeStatus|PacemakerClusterFencingAgentStatus|PacemakerClusterResourceStatus) is missing the following markers: optional" + - linters: + - kubeapilinter + # ConsoleSpec.Ingress is a legacy optional value struct. Requiring properties would + # change the validation of the stable API, so preserve the existing wire behavior. + path: '^operator/v1/types_console\.go$' + text: '^minlength: field ConsoleSpec\.Ingress type ConsoleIngress must have either a required field or a minimum properties, add kubebuilder:validation:MinProperties marker$' + - linters: + - kubeapilinter + # ConsoleSpec.Ingress is intentionally a value struct in the stable API; changing + # it to a pointer would break existing Go consumers. + path: '^operator/v1/types_console\.go$' + text: '^optionalfields: field ConsoleSpec\.Ingress has a valid zero value \(\{"consoleURL": "", "clientDownloadsURL": ""\}\) and should be a pointer\.$' + - linters: + - kubeapilinter + # Preserve the legacy JSON serialization of ConsoleSpec.Ingress. + path: '^operator/v1/types_console\.go$' + text: '^optionalfields: field ConsoleSpec\.Ingress should have the omitempty tag\.$' - linters: - kubeapilinter path: features|payload-command/ diff --git a/vendor/github.com/openshift/api/Dockerfile.ocp b/vendor/github.com/openshift/api/Dockerfile.ocp index 98870518c265..0eb4bf192724 100644 --- a/vendor/github.com/openshift/api/Dockerfile.ocp +++ b/vendor/github.com/openshift/api/Dockerfile.ocp @@ -1,4 +1,4 @@ -FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.0 AS builder +FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-5.1 AS builder WORKDIR /go/src/github.com/openshift/api COPY . . ENV GO_PACKAGE github.com/openshift/api diff --git a/vendor/github.com/openshift/api/Makefile b/vendor/github.com/openshift/api/Makefile index b6c0de378c75..0ae656dfaeed 100644 --- a/vendor/github.com/openshift/api/Makefile +++ b/vendor/github.com/openshift/api/Makefile @@ -4,7 +4,7 @@ all: build update: update-non-codegen update-codegen RUNTIME ?= podman -RUNTIME_IMAGE_NAME ?= registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0 +RUNTIME_IMAGE_NAME ?= registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.1 EXCLUDE_DIRS := _output/ dependencymagnet/ hack/ third_party/ tls/ tools/ vendor/ tests/ GO_PACKAGES :=$(addsuffix ...,$(addprefix ./,$(filter-out $(EXCLUDE_DIRS), $(wildcard */)))) diff --git a/vendor/github.com/openshift/api/apiextensions/install.go b/vendor/github.com/openshift/api/apiextensions/install.go index adaca4d6bade..6691adc1aece 100644 --- a/vendor/github.com/openshift/api/apiextensions/install.go +++ b/vendor/github.com/openshift/api/apiextensions/install.go @@ -4,6 +4,7 @@ import ( "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" + apiextensionsv1 "github.com/openshift/api/apiextensions/v1" apiextensionsv1alpha1 "github.com/openshift/api/apiextensions/v1alpha1" ) @@ -12,7 +13,7 @@ const ( ) var ( - schemeBuilder = runtime.NewSchemeBuilder(apiextensionsv1alpha1.Install) + schemeBuilder = runtime.NewSchemeBuilder(apiextensionsv1alpha1.Install, apiextensionsv1.Install) // Install is a function which adds every version of this group to a scheme Install = schemeBuilder.AddToScheme ) diff --git a/vendor/github.com/openshift/api/apiextensions/v1/Makefile b/vendor/github.com/openshift/api/apiextensions/v1/Makefile new file mode 100644 index 000000000000..0d5fd08072de --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/Makefile @@ -0,0 +1,3 @@ +.PHONY: test +test: + make -C ../../tests test GINKGO_EXTRA_ARGS=--focus="apiextensions.openshift.io/v1" diff --git a/vendor/github.com/openshift/api/apiextensions/v1/doc.go b/vendor/github.com/openshift/api/apiextensions/v1/doc.go new file mode 100644 index 000000000000..546341666392 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/doc.go @@ -0,0 +1,9 @@ +// +k8s:deepcopy-gen=package,register +// +k8s:defaulter-gen=TypeMeta +// +k8s:openapi-gen=true +// +k8s:openapi-model-package=com.github.openshift.api.apiextensions.v1 +// +openshift:featuregated-schema-gen=true + +// +groupName=apiextensions.openshift.io +// Package v1 is the v1 version of the API. +package v1 diff --git a/vendor/github.com/openshift/api/apiextensions/v1/register.go b/vendor/github.com/openshift/api/apiextensions/v1/register.go new file mode 100644 index 000000000000..4e1d4d826d76 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/register.go @@ -0,0 +1,39 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +var ( + GroupName = "apiextensions.openshift.io" + GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"} + schemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) + // Install is a function which adds this version to a scheme + Install = schemeBuilder.AddToScheme + + // SchemeGroupVersion generated code relies on this name + // Deprecated + SchemeGroupVersion = GroupVersion + // AddToScheme exists solely to keep the old generators creating valid code + // DEPRECATED + AddToScheme = schemeBuilder.AddToScheme +) + +// Resource generated code relies on this being here, but it logically belongs to the group +// DEPRECATED +func Resource(resource string) schema.GroupResource { + return schema.GroupResource{Group: GroupName, Resource: resource} +} + +func addKnownTypes(scheme *runtime.Scheme) error { + metav1.AddToGroupVersion(scheme, GroupVersion) + + scheme.AddKnownTypes(GroupVersion, + &CompatibilityRequirement{}, + &CompatibilityRequirementList{}, + ) + + return nil +} diff --git a/vendor/github.com/openshift/api/apiextensions/v1/types_compatibilityrequirement.go b/vendor/github.com/openshift/api/apiextensions/v1/types_compatibilityrequirement.go new file mode 100644 index 000000000000..f513908f91d2 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/types_compatibilityrequirement.go @@ -0,0 +1,391 @@ +package v1 + +import ( + admissionregistrationv1 "k8s.io/api/admissionregistration/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// CompatibilityRequirement expresses a set of requirements on a target CRD. +// It is used to ensure compatibility between different actors using the same +// CRD. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +// +openshift:file-pattern=cvoRunLevel=0000_20,operatorName=crd-compatibility-checker,operatorOrdering=01 +// +openshift:enable:FeatureGate=CRDCompatibilityRequirementOperator +// +kubebuilder:object:root=true +// +kubebuilder:subresource:status +// +kubebuilder:resource:path=compatibilityrequirements,scope=Cluster +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2905 +// +kubebuilder:metadata:annotations="release.openshift.io/feature-gate=CRDCompatibilityRequirementOperator" +type CompatibilityRequirement struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +required + metav1.ObjectMeta `json:"metadata,omitzero"` + + // spec is the specification of the desired behavior of the Compatibility Requirement. + // +required + Spec CompatibilityRequirementSpec `json:"spec,omitzero"` + + // status is the most recently observed status of the Compatibility Requirement. + // +optional + Status CompatibilityRequirementStatus `json:"status,omitzero"` +} + +// CompatibilityRequirementSpec is the specification of the desired behavior of the Compatibility Requirement. +type CompatibilityRequirementSpec struct { + // compatibilitySchema defines the schema used by + // customResourceDefinitionSchemaValidation and objectSchemaValidation. + // This field is required. + // +required + CompatibilitySchema CompatibilitySchema `json:"compatibilitySchema,omitzero"` + + // customResourceDefinitionSchemaValidation ensures that updates to the + // installed CRD are compatible with this compatibility requirement. If not + // specified, admission of the target CRD will not be validated. + // This field is optional. + // +optional + CustomResourceDefinitionSchemaValidation CustomResourceDefinitionSchemaValidation `json:"customResourceDefinitionSchemaValidation,omitzero"` + + // objectSchemaValidation ensures that matching resources conform to + // compatibilitySchema. If not specified, admission of matching resources + // will not be validated. + // This field is optional. + // +optional + ObjectSchemaValidation ObjectSchemaValidation `json:"objectSchemaValidation,omitzero"` +} + +// CRDDataType indicates the type of the CRD data. +// +kubebuilder:validation:Enum=YAML +type CRDDataType string + +const ( + // CRDDataTypeYAML indicates that the CRD data is in YAML format. + CRDDataTypeYAML CRDDataType = "YAML" +) + +// CRDData contains the complete definition of a CRD. +type CRDData struct { + // type indicates the type of the CRD data. The only supported type is "YAML". + // When set to YAML, the value in the data field is expected to be a valid YAML document. + // This field is required. + // +required + Type CRDDataType `json:"type,omitempty"` + + // data contains the complete definition of the CRD. This field must be in + // the format specified by the type field. It may not be longer than 1572864 + // characters. + // This field is required. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1572864 + // +required + Data string `json:"data,omitempty"` +} + +// APIVersionSelectionType specifies a method for automatically selecting a +// set of API versions to require. +// +kubebuilder:validation:Enum=StorageOnly;AllServed +type APIVersionSelectionType string + +const ( + APIVersionSetTypeStorageOnly APIVersionSelectionType = "StorageOnly" + APIVersionSetTypeAllServed APIVersionSelectionType = "AllServed" +) + +// APIVersionString is a string representing a kubernetes API version. +// +kubebuilder:validation:MinLength=1 +// +kubebuilder:validation:MaxLength=63 +// +kubebuilder:validation:XValidation:rule="!format.dns1035Label().validate(self).hasValue()",message="It must contain only lower-case alphanumeric characters and hyphens and must start with an alphabetic character and end with an alphanumeric character" +type APIVersionString string + +// APIVersions specifies a set of API versions of a CRD. +// +kubebuilder:validation:XValidation:rule="self.defaultSelection != 'AllServed' || !has(self.additionalVersions)",message="additionalVersions may not be defined when defaultSelection is 'AllServed'" +type APIVersions struct { + // defaultSelection specifies a method for automatically selecting a set of + // versions to require. + // + // Valid options are StorageOnly and AllServed. + // When set to StorageOnly, only the storage version is selected for + // compatibility assessment. + // When set to AllServed, all served versions are selected for compatibility + // assessment. + // + // This field is required. + // +required + DefaultSelection APIVersionSelectionType `json:"defaultSelection,omitempty"` + + // additionalVersions specifies a set api versions to require in addition to + // the default selection. It is explicitly permitted to specify a version in + // additionalVersions which was also selected by the default selection. The + // selections will be merged and deduplicated. + // + // Each item must be at most 63 characters in length, and must consist + // of only lowercase alphanumeric characters and hyphens, and must start + // with an alphabetic character and end with an alphanumeric character. + // At most 32 additional versions may be specified. + // + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + // +listType=set + // +optional + AdditionalVersions []APIVersionString `json:"additionalVersions,omitempty"` +} + +// APIExcludedField describes a field in the schema which will not be validated by +// crdSchemaValidation or objectSchemaValidation. +type APIExcludedField struct { + // path is the path to the field in the schema. + // Paths are dot-separated field names (e.g., "fieldA.fieldB.fieldC") representing nested object fields. + // If part of the path is a slice (e.g., "status.conditions") the remaining path is applied to all items in the slice + // (e.g., "status.conditions.lastTransitionTimestamp"). + // Each field name must be a valid Kubernetes CRD field name: start with a letter, contain only + // letters, digits, and underscores, and be between 1 and 63 characters in length. + // A path may contain at most 16 fields. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=1023 + // +kubebuilder:validation:XValidation:rule="self.split('.').size() <= 16",message="There may be at most 16 fields in the path." + // +kubebuilder:validation:XValidation:rule="self.split('.', 16).all(f, f.matches('^[a-zA-Z][a-zA-Z0-9_]{0,62}$'))",message="path must be dot-separated field names, each starting with a letter and containing only letters, digits, and underscores not exceeding 63 characters. There may be at most 16 fields in the path." + // +required + Path string `json:"path,omitempty"` + + // versions are the API versions the field is excluded from. + // When not specified, the field is excluded from all versions. + // + // Each item must be at most 63 characters in length, and must + // consist of only lowercase alphanumeric characters and hyphens, and must + // start with an alphabetic character and end with an alphanumeric + // character. + // At most 32 versions may be specified. + // + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + // +listType=set + // +required + Versions []APIVersionString `json:"versions,omitempty"` +} + +// CompatibilitySchema defines the schema used by crdSchemaValidation and objectSchemaValidation. +type CompatibilitySchema struct { + // customResourceDefinition contains the complete definition of the CRD for schema and object validation purposes. + // This field is required. + // +required + CustomResourceDefinition CRDData `json:"customResourceDefinition,omitzero"` + + // requiredVersions specifies a subset of the CRD's API versions which will be asserted for compatibility. + // This field is required. + // +required + RequiredVersions APIVersions `json:"requiredVersions,omitzero"` + + // excludedFields is a set of fields in the schema which will not be validated by + // crdSchemaValidation or objectSchemaValidation. + // The list may contain at most 64 fields. + // Each path in the list must be unique. + // When not specified, all fields in the schema will be validated. + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=64 + // +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, y.path == x.path))",message="each path in the list must be unique." + // +listType=atomic + // +optional + ExcludedFields []APIExcludedField `json:"excludedFields,omitempty"` +} + +// CustomResourceDefinitionSchemaValidation ensures that updates to the installed CRD are compatible with this compatibility requirement. +type CustomResourceDefinitionSchemaValidation struct { + // action determines whether violations are rejected (Deny) or admitted with an API warning (Warn). + // Valid options are Deny and Warn. + // When set to Deny, incompatible CRDs will be rejected and not admitted to the cluster. + // When set to Warn, incompatible CRDs will be allowed but a warning will be generated in the API response. + // This field is required. + // +required + Action CRDAdmitAction `json:"action,omitempty"` +} + +// ObjectSchemaValidation ensures that matching objects conform to the compatibilitySchema. +type ObjectSchemaValidation struct { + // action determines whether violations are rejected (Deny) or admitted with an API warning (Warn). + // Valid options are Deny and Warn. + // When set to Deny, incompatible Objects will be rejected and not admitted to the cluster. + // When set to Warn, incompatible Objects will be allowed but a warning will be generated in the API response. + // This field is required. + // +required + Action CRDAdmitAction `json:"action,omitempty"` + + // namespaceSelector defines a label selector for namespaces. If defined, + // only objects in a namespace with matching labels will be subject to + // validation. When not specified, objects for validation will not be + // filtered by namespace. + // +kubebuilder:validation:XValidation:rule="size(self.matchLabels) > 0 || size(self.matchExpressions) > 0",message="must have at least one of matchLabels or matchExpressions when specified" + // +optional + NamespaceSelector metav1.LabelSelector `json:"namespaceSelector,omitempty,omitzero"` + // objectSelector defines a label selector for objects. If defined, only + // objects with matching labels will be subject to validation. When not + // specified, objects for validation will not be filtered by label. + // +kubebuilder:validation:XValidation:rule="size(self.matchLabels) > 0 || size(self.matchExpressions) > 0",message="must have at least one of matchLabels or matchExpressions when specified" + // +optional + ObjectSelector metav1.LabelSelector `json:"objectSelector,omitempty,omitzero"` + + // matchConditions defines the matchConditions field of the resulting ValidatingWebhookConfiguration. + // When present, must contain between 1 and 64 match conditions. + // When not specified, the webhook will match all requests according to its other selectors. + // +listType=map + // +listMapKey=name + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=64 + // +optional + MatchConditions []admissionregistrationv1.MatchCondition `json:"matchConditions,omitempty"` +} + +// CRDAdmitAction determines the action taken when a CRD is not compatible. +// +kubebuilder:validation:Enum=Deny;Warn +// +enum +type CRDAdmitAction string + +const ( + // CRDAdmitActionDeny means that incompatible CRDs will be rejected. + CRDAdmitActionDeny CRDAdmitAction = "Deny" + + // CRDAdmitActionWarn means that incompatible CRDs will be allowed but a warning will be generated. + CRDAdmitActionWarn CRDAdmitAction = "Warn" +) + +// CompatibilityRequirement's Progressing condition and corresponding reasons. +const ( + // CompatibilityRequirementProgressing is false if the spec has been + // completely reconciled against the condition's observed generation. + // True indicates that reconciliation is still in progress and the current status does not represent + // a stable state. Progressing false with an error reason indicates that the object cannot be reconciled. + CompatibilityRequirementProgressing string = "Progressing" + + // CompatibilityRequirementConfigurationErrorReason indicates that + // reconciliation cannot progress due to an invalid spec. The controller + // will not reconcile this object again until the spec is updated. + CompatibilityRequirementConfigurationErrorReason string = "ConfigurationError" + + // CompatibilityRequirementTransientErrorReason indicates that + // reconciliation failed due to an error that can be retried. + CompatibilityRequirementTransientErrorReason string = "TransientError" + + // CompatibilityRequirementUpToDateReason surfaces when reconciliation + // completed successfully for the condition's observed generation. + CompatibilityRequirementUpToDateReason string = "UpToDate" +) + +// CompatibilityRequirement's Admitted condition and corresponding reasons. +const ( + // CompatibilityRequirementAdmitted is true if the requirement has been configured in the validating webhook, + // otherwise false. + CompatibilityRequirementAdmitted string = "Admitted" + + // CompatibilityRequirementAdmittedReason surfaces when the requirement has been configured in the validating webhook. + CompatibilityRequirementAdmittedReason string = "Admitted" + + // CompatibilityRequirementNotAdmittedReason surfaces when the requirement has not been configured in the validating webhook. + CompatibilityRequirementNotAdmittedReason string = "NotAdmitted" +) + +// CompatibilityRequirement's Compatible condition and corresponding reasons. +const ( + // CompatibilityRequirementCompatible is true if the observed CRD is compatible with the requirement, + // otherwise false. Note that Compatible may be false when adding a new requirement which the existing + // CRD does not meet. + CompatibilityRequirementCompatible string = "Compatible" + + // CompatibilityRequirementRequirementsNotMetReason surfaces when a CRD exists, and it is not compatible with this requirement. + CompatibilityRequirementRequirementsNotMetReason string = "RequirementsNotMet" + + // CompatibilityRequirementCRDNotFoundReason surfaces when the referenced CRD does not exist. + CompatibilityRequirementCRDNotFoundReason string = "CRDNotFound" + + // CompatibilityRequirementCompatibleWithWarningsReason surfaces when the CRD exists and is compatible with this requirement, but Message contains one or more warning messages. + CompatibilityRequirementCompatibleWithWarningsReason string = "CompatibleWithWarnings" + + // CompatibilityRequirementCompatibleReason surfaces when the CRD exists and is compatible with this requirement. + CompatibilityRequirementCompatibleReason string = "Compatible" +) + +// CompatibilityRequirementStatus defines the observed status of the Compatibility Requirement. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.crdName) || has(self.crdName) && oldSelf.crdName == self.crdName",message="crdName cannot be changed once set" +type CompatibilityRequirementStatus struct { + // conditions is a list of conditions and their status. + // Known condition types are Progressing, Admitted, and Compatible. + // + // The Progressing condition indicates if reconciliation of a CompatibilityRequirement is still + // progressing or has finished. + // + // The Admitted condition indicates if the validating webhook has been configured. + // + // The Compatible condition indicates if the observed CRD is compatible with the requirement. + // + // +optional + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // observedCRD documents the uid and generation of the CRD object when the current status was written. + // This field will be omitted if the target CRD does not exist or could not be retrieved. + // +optional + ObservedCRD ObservedCRD `json:"observedCRD,omitzero"` + + // crdName is the name of the target CRD. The target CRD is not required to + // exist, as we may legitimately place requirements on it before it is + // created. The observed CRD is given in status.observedCRD, which will be + // empty if no CRD is observed. + // When present, must be between 1 and 253 characters and conform to RFC 1123 subdomain format: + // lowercase alphanumeric characters, '-' or '.', starting and ending with alphanumeric characters. + // When not specified, the requirement applies to any CRD name discovered from the compatibility schema. + // This field is optional. Once set, the value cannot be changed and must always remain set. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character." + // +optional + CRDName string `json:"crdName,omitempty"` +} + +// ObservedCRD contains information about the observed target CRD. +// +kubebuilder:validation:XValidation:rule="oldSelf.uid != self.uid || self.generation >= oldSelf.generation",message="generation may only increase on the same CRD" +type ObservedCRD struct { + // uid is the uid of the observed CRD. + // Must be a valid UUID consisting of lowercase hexadecimal digits in 5 hyphenated blocks (8-4-4-4-12 format). + // Length must be between 1 and 36 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=36 + // +kubebuilder:validation:Format=uuid + // +required + UID string `json:"uid,omitempty"` + + // generation is the observed generation of the CRD. + // Must be a positive integer (minimum value of 1). + // +kubebuilder:validation:Minimum=1 + // +required + Generation int64 `json:"generation,omitempty"` +} + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// CompatibilityRequirementList is a collection of CompatibilityRequirements. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +type CompatibilityRequirementList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +optional + metav1.ListMeta `json:"metadata,omitzero"` + + // items is a list of CompatibilityRequirements. + // +kubebuilder:validation:MaxItems=1000 + // +optional + Items []CompatibilityRequirement `json:"items,omitempty"` +} diff --git a/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.deepcopy.go new file mode 100644 index 000000000000..d8875d1e10e7 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.deepcopy.go @@ -0,0 +1,254 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by codegen. DO NOT EDIT. + +package v1 + +import ( + admissionregistrationv1 "k8s.io/api/admissionregistration/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *APIExcludedField) DeepCopyInto(out *APIExcludedField) { + *out = *in + if in.Versions != nil { + in, out := &in.Versions, &out.Versions + *out = make([]APIVersionString, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIExcludedField. +func (in *APIExcludedField) DeepCopy() *APIExcludedField { + if in == nil { + return nil + } + out := new(APIExcludedField) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *APIVersions) DeepCopyInto(out *APIVersions) { + *out = *in + if in.AdditionalVersions != nil { + in, out := &in.AdditionalVersions, &out.AdditionalVersions + *out = make([]APIVersionString, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIVersions. +func (in *APIVersions) DeepCopy() *APIVersions { + if in == nil { + return nil + } + out := new(APIVersions) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CRDData) DeepCopyInto(out *CRDData) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CRDData. +func (in *CRDData) DeepCopy() *CRDData { + if in == nil { + return nil + } + out := new(CRDData) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CompatibilityRequirement) DeepCopyInto(out *CompatibilityRequirement) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompatibilityRequirement. +func (in *CompatibilityRequirement) DeepCopy() *CompatibilityRequirement { + if in == nil { + return nil + } + out := new(CompatibilityRequirement) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *CompatibilityRequirement) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CompatibilityRequirementList) DeepCopyInto(out *CompatibilityRequirementList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]CompatibilityRequirement, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompatibilityRequirementList. +func (in *CompatibilityRequirementList) DeepCopy() *CompatibilityRequirementList { + if in == nil { + return nil + } + out := new(CompatibilityRequirementList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *CompatibilityRequirementList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CompatibilityRequirementSpec) DeepCopyInto(out *CompatibilityRequirementSpec) { + *out = *in + in.CompatibilitySchema.DeepCopyInto(&out.CompatibilitySchema) + out.CustomResourceDefinitionSchemaValidation = in.CustomResourceDefinitionSchemaValidation + in.ObjectSchemaValidation.DeepCopyInto(&out.ObjectSchemaValidation) + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompatibilityRequirementSpec. +func (in *CompatibilityRequirementSpec) DeepCopy() *CompatibilityRequirementSpec { + if in == nil { + return nil + } + out := new(CompatibilityRequirementSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CompatibilityRequirementStatus) DeepCopyInto(out *CompatibilityRequirementStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + out.ObservedCRD = in.ObservedCRD + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompatibilityRequirementStatus. +func (in *CompatibilityRequirementStatus) DeepCopy() *CompatibilityRequirementStatus { + if in == nil { + return nil + } + out := new(CompatibilityRequirementStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CompatibilitySchema) DeepCopyInto(out *CompatibilitySchema) { + *out = *in + out.CustomResourceDefinition = in.CustomResourceDefinition + in.RequiredVersions.DeepCopyInto(&out.RequiredVersions) + if in.ExcludedFields != nil { + in, out := &in.ExcludedFields, &out.ExcludedFields + *out = make([]APIExcludedField, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompatibilitySchema. +func (in *CompatibilitySchema) DeepCopy() *CompatibilitySchema { + if in == nil { + return nil + } + out := new(CompatibilitySchema) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *CustomResourceDefinitionSchemaValidation) DeepCopyInto(out *CustomResourceDefinitionSchemaValidation) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CustomResourceDefinitionSchemaValidation. +func (in *CustomResourceDefinitionSchemaValidation) DeepCopy() *CustomResourceDefinitionSchemaValidation { + if in == nil { + return nil + } + out := new(CustomResourceDefinitionSchemaValidation) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ObjectSchemaValidation) DeepCopyInto(out *ObjectSchemaValidation) { + *out = *in + in.NamespaceSelector.DeepCopyInto(&out.NamespaceSelector) + in.ObjectSelector.DeepCopyInto(&out.ObjectSelector) + if in.MatchConditions != nil { + in, out := &in.MatchConditions, &out.MatchConditions + *out = make([]admissionregistrationv1.MatchCondition, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectSchemaValidation. +func (in *ObjectSchemaValidation) DeepCopy() *ObjectSchemaValidation { + if in == nil { + return nil + } + out := new(ObjectSchemaValidation) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ObservedCRD) DeepCopyInto(out *ObservedCRD) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObservedCRD. +func (in *ObservedCRD) DeepCopy() *ObservedCRD { + if in == nil { + return nil + } + out := new(ObservedCRD) + in.DeepCopyInto(out) + return out +} diff --git a/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.featuregated-crd-manifests.yaml new file mode 100644 index 000000000000..fe9490d2d96e --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.featuregated-crd-manifests.yaml @@ -0,0 +1,24 @@ +compatibilityrequirements.apiextensions.openshift.io: + Annotations: + release.openshift.io/feature-gate: CRDCompatibilityRequirementOperator + ApprovedPRNumber: https://github.com/openshift/api/pull/2905 + CRDName: compatibilityrequirements.apiextensions.openshift.io + Capability: "" + Category: "" + FeatureGates: + - CRDCompatibilityRequirementOperator + FilenameOperatorName: crd-compatibility-checker + FilenameOperatorOrdering: "01" + FilenameRunLevel: "0000_20" + GroupName: apiextensions.openshift.io + HasStatus: true + KindName: CompatibilityRequirement + Labels: {} + PluralName: compatibilityrequirements + PrinterColumns: [] + Scope: Cluster + ShortNames: null + TopLevelFeatureGates: + - CRDCompatibilityRequirementOperator + Version: v1 + diff --git a/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.model_name.go new file mode 100644 index 000000000000..13d9de159312 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.model_name.go @@ -0,0 +1,61 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by codegen. DO NOT EDIT. + +package v1 + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in APIExcludedField) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.APIExcludedField" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in APIVersions) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.APIVersions" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CRDData) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CRDData" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CompatibilityRequirement) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CompatibilityRequirement" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CompatibilityRequirementList) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CompatibilityRequirementList" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CompatibilityRequirementSpec) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CompatibilityRequirementSpec" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CompatibilityRequirementStatus) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CompatibilityRequirementStatus" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CompatibilitySchema) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CompatibilitySchema" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in CustomResourceDefinitionSchemaValidation) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.CustomResourceDefinitionSchemaValidation" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ObjectSchemaValidation) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.ObjectSchemaValidation" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ObservedCRD) OpenAPIModelName() string { + return "com.github.openshift.api.apiextensions.v1.ObservedCRD" +} diff --git a/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.swagger_doc_generated.go new file mode 100644 index 000000000000..4f6c087c2136 --- /dev/null +++ b/vendor/github.com/openshift/api/apiextensions/v1/zz_generated.swagger_doc_generated.go @@ -0,0 +1,129 @@ +package v1 + +// This file contains a collection of methods that can be used from go-restful to +// generate Swagger API documentation for its models. Please read this PR for more +// information on the implementation: https://github.com/emicklei/go-restful/pull/215 +// +// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if +// they are on one line! For multiple line or blocks that you want to ignore use ---. +// Any context after a --- is ignored. +// +// Those methods can be generated by using hack/update-swagger-docs.sh + +// AUTO-GENERATED FUNCTIONS START HERE +var map_APIExcludedField = map[string]string{ + "": "APIExcludedField describes a field in the schema which will not be validated by crdSchemaValidation or objectSchemaValidation.", + "path": "path is the path to the field in the schema. Paths are dot-separated field names (e.g., \"fieldA.fieldB.fieldC\") representing nested object fields. If part of the path is a slice (e.g., \"status.conditions\") the remaining path is applied to all items in the slice (e.g., \"status.conditions.lastTransitionTimestamp\"). Each field name must be a valid Kubernetes CRD field name: start with a letter, contain only letters, digits, and underscores, and be between 1 and 63 characters in length. A path may contain at most 16 fields.", + "versions": "versions are the API versions the field is excluded from. When not specified, the field is excluded from all versions.\n\nEach item must be at most 63 characters in length, and must consist of only lowercase alphanumeric characters and hyphens, and must start with an alphabetic character and end with an alphanumeric character. At most 32 versions may be specified.", +} + +func (APIExcludedField) SwaggerDoc() map[string]string { + return map_APIExcludedField +} + +var map_APIVersions = map[string]string{ + "": "APIVersions specifies a set of API versions of a CRD.", + "defaultSelection": "defaultSelection specifies a method for automatically selecting a set of versions to require.\n\nValid options are StorageOnly and AllServed. When set to StorageOnly, only the storage version is selected for compatibility assessment. When set to AllServed, all served versions are selected for compatibility assessment.\n\nThis field is required.", + "additionalVersions": "additionalVersions specifies a set api versions to require in addition to the default selection. It is explicitly permitted to specify a version in additionalVersions which was also selected by the default selection. The selections will be merged and deduplicated.\n\nEach item must be at most 63 characters in length, and must consist of only lowercase alphanumeric characters and hyphens, and must start with an alphabetic character and end with an alphanumeric character. At most 32 additional versions may be specified.", +} + +func (APIVersions) SwaggerDoc() map[string]string { + return map_APIVersions +} + +var map_CRDData = map[string]string{ + "": "CRDData contains the complete definition of a CRD.", + "type": "type indicates the type of the CRD data. The only supported type is \"YAML\". When set to YAML, the value in the data field is expected to be a valid YAML document. This field is required.", + "data": "data contains the complete definition of the CRD. This field must be in the format specified by the type field. It may not be longer than 1572864 characters. This field is required.", +} + +func (CRDData) SwaggerDoc() map[string]string { + return map_CRDData +} + +var map_CompatibilityRequirement = map[string]string{ + "": "CompatibilityRequirement expresses a set of requirements on a target CRD. It is used to ensure compatibility between different actors using the same CRD.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "spec": "spec is the specification of the desired behavior of the Compatibility Requirement.", + "status": "status is the most recently observed status of the Compatibility Requirement.", +} + +func (CompatibilityRequirement) SwaggerDoc() map[string]string { + return map_CompatibilityRequirement +} + +var map_CompatibilityRequirementList = map[string]string{ + "": "CompatibilityRequirementList is a collection of CompatibilityRequirements.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of CompatibilityRequirements.", +} + +func (CompatibilityRequirementList) SwaggerDoc() map[string]string { + return map_CompatibilityRequirementList +} + +var map_CompatibilityRequirementSpec = map[string]string{ + "": "CompatibilityRequirementSpec is the specification of the desired behavior of the Compatibility Requirement.", + "compatibilitySchema": "compatibilitySchema defines the schema used by customResourceDefinitionSchemaValidation and objectSchemaValidation. This field is required.", + "customResourceDefinitionSchemaValidation": "customResourceDefinitionSchemaValidation ensures that updates to the installed CRD are compatible with this compatibility requirement. If not specified, admission of the target CRD will not be validated. This field is optional.", + "objectSchemaValidation": "objectSchemaValidation ensures that matching resources conform to compatibilitySchema. If not specified, admission of matching resources will not be validated. This field is optional.", +} + +func (CompatibilityRequirementSpec) SwaggerDoc() map[string]string { + return map_CompatibilityRequirementSpec +} + +var map_CompatibilityRequirementStatus = map[string]string{ + "": "CompatibilityRequirementStatus defines the observed status of the Compatibility Requirement.", + "conditions": "conditions is a list of conditions and their status. Known condition types are Progressing, Admitted, and Compatible.\n\nThe Progressing condition indicates if reconciliation of a CompatibilityRequirement is still progressing or has finished.\n\nThe Admitted condition indicates if the validating webhook has been configured.\n\nThe Compatible condition indicates if the observed CRD is compatible with the requirement.", + "observedCRD": "observedCRD documents the uid and generation of the CRD object when the current status was written. This field will be omitted if the target CRD does not exist or could not be retrieved.", + "crdName": "crdName is the name of the target CRD. The target CRD is not required to exist, as we may legitimately place requirements on it before it is created. The observed CRD is given in status.observedCRD, which will be empty if no CRD is observed. When present, must be between 1 and 253 characters and conform to RFC 1123 subdomain format: lowercase alphanumeric characters, '-' or '.', starting and ending with alphanumeric characters. When not specified, the requirement applies to any CRD name discovered from the compatibility schema. This field is optional. Once set, the value cannot be changed and must always remain set.", +} + +func (CompatibilityRequirementStatus) SwaggerDoc() map[string]string { + return map_CompatibilityRequirementStatus +} + +var map_CompatibilitySchema = map[string]string{ + "": "CompatibilitySchema defines the schema used by crdSchemaValidation and objectSchemaValidation.", + "customResourceDefinition": "customResourceDefinition contains the complete definition of the CRD for schema and object validation purposes. This field is required.", + "requiredVersions": "requiredVersions specifies a subset of the CRD's API versions which will be asserted for compatibility. This field is required.", + "excludedFields": "excludedFields is a set of fields in the schema which will not be validated by crdSchemaValidation or objectSchemaValidation. The list may contain at most 64 fields. Each path in the list must be unique. When not specified, all fields in the schema will be validated.", +} + +func (CompatibilitySchema) SwaggerDoc() map[string]string { + return map_CompatibilitySchema +} + +var map_CustomResourceDefinitionSchemaValidation = map[string]string{ + "": "CustomResourceDefinitionSchemaValidation ensures that updates to the installed CRD are compatible with this compatibility requirement.", + "action": "action determines whether violations are rejected (Deny) or admitted with an API warning (Warn). Valid options are Deny and Warn. When set to Deny, incompatible CRDs will be rejected and not admitted to the cluster. When set to Warn, incompatible CRDs will be allowed but a warning will be generated in the API response. This field is required.", +} + +func (CustomResourceDefinitionSchemaValidation) SwaggerDoc() map[string]string { + return map_CustomResourceDefinitionSchemaValidation +} + +var map_ObjectSchemaValidation = map[string]string{ + "": "ObjectSchemaValidation ensures that matching objects conform to the compatibilitySchema.", + "action": "action determines whether violations are rejected (Deny) or admitted with an API warning (Warn). Valid options are Deny and Warn. When set to Deny, incompatible Objects will be rejected and not admitted to the cluster. When set to Warn, incompatible Objects will be allowed but a warning will be generated in the API response. This field is required.", + "namespaceSelector": "namespaceSelector defines a label selector for namespaces. If defined, only objects in a namespace with matching labels will be subject to validation. When not specified, objects for validation will not be filtered by namespace.", + "objectSelector": "objectSelector defines a label selector for objects. If defined, only objects with matching labels will be subject to validation. When not specified, objects for validation will not be filtered by label.", + "matchConditions": "matchConditions defines the matchConditions field of the resulting ValidatingWebhookConfiguration. When present, must contain between 1 and 64 match conditions. When not specified, the webhook will match all requests according to its other selectors.", +} + +func (ObjectSchemaValidation) SwaggerDoc() map[string]string { + return map_ObjectSchemaValidation +} + +var map_ObservedCRD = map[string]string{ + "": "ObservedCRD contains information about the observed target CRD.", + "uid": "uid is the uid of the observed CRD. Must be a valid UUID consisting of lowercase hexadecimal digits in 5 hyphenated blocks (8-4-4-4-12 format). Length must be between 1 and 36 characters.", + "generation": "generation is the observed generation of the CRD. Must be a positive integer (minimum value of 1).", +} + +func (ObservedCRD) SwaggerDoc() map[string]string { + return map_ObservedCRD +} + +// AUTO-GENERATED FUNCTIONS END HERE diff --git a/vendor/github.com/openshift/api/authentication/install.go b/vendor/github.com/openshift/api/authentication/install.go new file mode 100644 index 000000000000..8d27dd1acd22 --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/install.go @@ -0,0 +1,24 @@ +package authentication + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + + authenticationv1alpha1 "github.com/openshift/api/authentication/v1alpha1" +) + +const GroupName = "authentication.openshift.io" + +var ( + schemeBuilder = runtime.NewSchemeBuilder(authenticationv1alpha1.Install) + // Install adds every version of this group to a scheme. + Install = schemeBuilder.AddToScheme +) + +func Resource(resource string) schema.GroupResource { + return schema.GroupResource{Group: GroupName, Resource: resource} +} + +func Kind(kind string) schema.GroupKind { + return schema.GroupKind{Group: GroupName, Kind: kind} +} diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/doc.go b/vendor/github.com/openshift/api/authentication/v1alpha1/doc.go new file mode 100644 index 000000000000..5c21b5d6008b --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/doc.go @@ -0,0 +1,9 @@ +// +k8s:deepcopy-gen=package,register +// +k8s:conversion-gen=github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication +// +k8s:defaulter-gen=TypeMeta +// +k8s:openapi-gen=true +// +k8s:openapi-model-package=com.github.openshift.api.authentication.v1alpha1 + +// +groupName=authentication.openshift.io +// Package v1alpha1 is the v1alpha1 version of the external OIDC authentication configuration API. +package v1alpha1 diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/register.go b/vendor/github.com/openshift/api/authentication/v1alpha1/register.go new file mode 100644 index 000000000000..d8f14e17d252 --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/register.go @@ -0,0 +1,33 @@ +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const GroupName = "authentication.openshift.io" + +var ( + GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + schemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) + // Install adds this version to a scheme. + Install = schemeBuilder.AddToScheme + + // SchemeGroupVersion is retained for generated-code compatibility. + // Deprecated. + SchemeGroupVersion = GroupVersion + // AddToScheme is retained for generated-code compatibility. + // Deprecated. + AddToScheme = schemeBuilder.AddToScheme +) + +// Resource is retained for generated-code compatibility. +// Deprecated. +func Resource(resource string) schema.GroupResource { + return GroupVersion.WithResource(resource).GroupResource() +} + +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(GroupVersion, &AuthenticationConfiguration{}) + return nil +} diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/types_authentication_configuration.go b/vendor/github.com/openshift/api/authentication/v1alpha1/types_authentication_configuration.go new file mode 100644 index 000000000000..fd69a7bd0023 --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/types_authentication_configuration.go @@ -0,0 +1,585 @@ +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +/* + +The types in this file are heavily inspired by the existing +Kubernetes AuthenticationConfiguration type found at +https://github.com/kubernetes/kubernetes/blob/b2f73c0d6b427e2ab5ba225375aaefc0b9bc45b2/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go#L56 + +The API surface here intentionally aligns with this API because it is meant +to be a wrapper around that API with some customization to support unique +functionality that OpenShift needs. + +*/ + +// AuthenticationConfiguration is the configuration-file API read by the +// oauth-apiserver when it runs in External OIDC mode. +// +// The cluster-authentication-operator is the only component that writes this +// configuration file. It generates the file from the user-facing +// config.openshift.io/v1, Kind=Authentication API. This type is not a CRD and +// must not be configured directly. +// +// The oauth-apiserver performs semantic validation when it reads this file. See +// https://github.com/openshift/oauth-apiserver/blob/97a820bd5412/pkg/externaloidc/apis/authentication/validation/validation.go. +// +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object +// +// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. +// +openshift:compatibility-gen:level=4 +// +openshift:compatibility-gen:internal +type AuthenticationConfiguration struct { + metav1.TypeMeta `json:",inline"` + + // trustedCAFilePath is an optional path to a PEM-encoded CA bundle used to + // verify outbound HTTPS connections including proxies and TLS-intercepting proxies + // for outbound issuer discovery and JWKS requests. + // When specified, the file is watched and updates are applied without restarting + // the webhook server. When omitted, connections use the system trust roots only. + // +optional + // +openshift:enable:FeatureGate=AuthenticationComponentProxyExternalOIDC + TrustedCAFilePath string `json:"trustedCAFilePath,omitempty"` + + // jwt is a list of authenticator to authenticate Kubernetes users using + // JWT compliant tokens. The authenticator will attempt to parse a raw ID token, + // verify it's been signed by the configured issuer. The public key to verify the + // signature is discovered from the issuer's public endpoint using OIDC discovery. + // For an incoming token, each JWT authenticator will be attempted in + // the order in which it is specified in this list. Note however that + // other authenticators may run before or after the JWT authenticators. + // The specific position of JWT authenticators in relation to other + // authenticators is neither defined nor stable across releases. Since + // each JWT authenticator must have a unique issuer URL, at most one + // JWT authenticator will attempt to cryptographically validate the token. + // + // The minimum valid JWT payload must contain the following claims: + // { + // "iss": "https://issuer.example.com", + // "aud": ["audience"], + // "exp": 1234567890, + // "": "username" + // } + // +listType=atomic + JWT []JWTAuthenticator `json:"jwt,omitempty"` +} + +// JWTAuthenticator configures one JWT authenticator. +type JWTAuthenticator struct { + // issuer contains the basic OIDC provider connection options. + // +required + Issuer *Issuer `json:"issuer,omitempty"` + + // claimValidationRules are rules that are applied to validate token claims to authenticate users. + // +listType=atomic + // +optional + ClaimValidationRules []ClaimValidationRule `json:"claimValidationRules,omitempty"` + + // claimMappings points claims of a token to be treated as user attributes. + // +required + ClaimMappings *ClaimMappings `json:"claimMappings,omitempty"` + + // userValidationRules are rules that are applied to final user before completing authentication. + // These allow invariants to be applied to incoming identities such as preventing the + // use of the system: prefix that is commonly used by Kubernetes components. + // The validation rules are logically ANDed together and must all return true for the validation to pass. + // +listType=atomic + // +optional + UserValidationRules []UserValidationRule `json:"userValidationRules,omitempty"` + + // externalClaimsSources is an optional field that can be used to configure + // sources, external to the token provided in a request, in which claims + // should be fetched from and made available to the claim mapping process + // that is used to build the identity of a token holder. + // For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint. + // externalClaimsSources must not exceed 5 entries. + // +listType=atomic + // +optional + ExternalClaimsSources []ExternalClaimsSource `json:"externalClaimsSources,omitempty"` +} + +// Issuer provides the configuration for an external provider's specific settings. +type Issuer struct { + // url points to the issuer URL in a format https://url or https://url/path. + // This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. + // Same value as the --oidc-issuer-url flag. + // Discovery information is fetched from "{url}/.well-known/openid-configuration" unless overridden by discoveryURL. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +required + URL string `json:"url"` + + // discoveryURL, if specified, overrides the URL used to fetch discovery + // information instead of using "{url}/.well-known/openid-configuration". + // The exact value specified is used, so "/.well-known/openid-configuration" + // must be included in discoveryURL if needed. + // + // The "issuer" field in the fetched discovery information must match the "issuer.url" field + // in the AuthenticationConfiguration and will be used to validate the "iss" claim in the presented JWT. + // This is for scenarios where the well-known and jwks endpoints are hosted at a different + // location than the issuer (such as locally in the cluster). + // + // Example: + // A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace' + // and discovery information is available at '/.well-known/openid-configuration'. + // discoveryURL: "https://oidc.oidc-namespace/.well-known/openid-configuration" + // certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate + // must be set to 'oidc.oidc-namespace'. + // + // curl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field) + // { + // issuer: "https://oidc.example.com" (.url field) + // } + // + // discoveryURL must be different from url. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +optional + DiscoveryURL string `json:"discoveryURL,omitempty"` + + // certificateAuthority contains PEM-encoded certificate authority certificates + // used to validate the connection when fetching discovery information. + // If unset, the system verifier is used. + // Same value as the content of the file referenced by the --oidc-ca-file flag. + // +optional + CertificateAuthority string `json:"certificateAuthority,omitempty"` + + // audiences is the set of acceptable audiences the JWT must be issued to. + // At least one of the entries must match the "aud" claim in presented JWTs. + // Same value as the --oidc-client-id flag (though this field supports an array). + // Required to be non-empty. + // +listType=atomic + // +required + Audiences []string `json:"audiences"` + + // audienceMatchPolicy defines how the "audiences" field is used to match the "aud" claim in the presented JWT. + // Allowed values are: + // 1. "MatchAny" when multiple audiences are specified and + // 2. empty (or unset) or "MatchAny" when a single audience is specified. + // + // - MatchAny: the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + // For example, if "audiences" is ["foo", "bar"], the "aud" claim in the presented JWT must contain either "foo" or "bar" (and may contain both). + // + // - "": The match policy can be empty (or unset) when a single audience is specified in the "audiences" field. The "aud" claim in the presented JWT must contain the single audience (and may contain others). + // + // For more nuanced audience validation, use claimValidationRules. + // example: claimValidationRule[].expression: 'sets.equivalent(claims.aud, ["bar", "foo", "baz"])' to require an exact match. + // +optional + AudienceMatchPolicy AudienceMatchPolicyType `json:"audienceMatchPolicy,omitempty"` +} + +// AudienceMatchPolicyType is a set of valid values for issuer.audienceMatchPolicy +type AudienceMatchPolicyType string + +// Valid types for AudienceMatchPolicyType +const ( + // MatchAny means the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + AudienceMatchPolicyMatchAny AudienceMatchPolicyType = "MatchAny" +) + +// ClaimValidationRule provides the configuration for a single claim validation rule. +type ClaimValidationRule struct { + // claim is the name of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim keys are supported. + // Mutually exclusive with expression and message. + // +optional + Claim string `json:"claim,omitempty"` + // requiredValue is the value of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim values are supported. + // If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string. + // Mutually exclusive with expression and message. + // +optional + RequiredValue string `json:"requiredValue,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // Must produce a boolean. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // Must return true for the validation to pass. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and requiredValue. + // +optional + Expression string `json:"expression,omitempty"` + // message customizes the returned error message when expression returns false. + // message is a literal string. + // Mutually exclusive with claim and requiredValue. + // +optional + Message string `json:"message,omitempty"` +} + +// ClaimMappings provides the configuration for claim mapping +type ClaimMappings struct { + // username represents an option for the username attribute. + // The claim's value must be a singular string. + // Same as the --oidc-username-claim and --oidc-username-prefix flags. + // If username.expression is set, the expression must produce a string value. + // If username.expression uses 'claims.email', then 'claims.email_verified' must be used in + // username.expression or extra[*].valueExpression or claimValidationRules[*].expression. + // An example claim validation rule expression that matches the validation automatically + // applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing + // the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified + // claim will be caught at runtime. + // + // In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, + // the default value is "sub". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly. + // For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim="sub" in the authentication config. + // For prefix: + // (1) --oidc-username-prefix="-", no prefix was added to the username. For the same behavior using authentication config, + // set username.prefix="" + // (2) --oidc-username-prefix="" and --oidc-username-claim != "email", prefix was "#". For the same + // behavior using authentication config, set username.prefix="#" + // (3) --oidc-username-prefix="". For the same behavior using authentication config, set username.prefix="" + // +required + Username PrefixedClaimOrExpression `json:"username"` + // groups represents an option for the groups attribute. + // The claim's value must be a string or string array claim. + // If groups.claim is set, the prefix must be specified (and can be the empty string). + // If groups.expression is set, the expression must produce a string or string array value. + // "", [], and null values are treated as the group mapping not being present. + // +optional + Groups PrefixedClaimOrExpression `json:"groups,omitempty"` + + // uid represents an option for the uid attribute. + // Claim must be a singular string claim. + // If uid.expression is set, the expression must produce a string value. + // +optional + UID ClaimOrExpression `json:"uid"` + + // extra represents an option for the extra attribute. + // expression must produce a string or string array value. + // If the value is empty, the extra mapping will not be present. + // + // hard-coded extra key/value + // - key: "foo" + // valueExpression: "'bar'" + // This will result in an extra attribute - foo: ["bar"] + // + // hard-coded key, value copying claim value + // - key: "foo" + // valueExpression: "claims.some_claim" + // This will result in an extra attribute - foo: [value of some_claim] + // + // hard-coded key, value derived from claim value + // - key: "admin" + // valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""' + // This will result in: + // - if is_admin claim is present and true, extra attribute - admin: ["true"] + // - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added + // + // +listType=atomic + // +optional + Extra []ExtraMapping `json:"extra,omitempty"` +} + +// PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression. +type PrefixedClaimOrExpression struct { + // claim is the JWT claim to use. + // Mutually exclusive with expression. + // +optional + Claim string `json:"claim,omitempty"` + // prefix is prepended to claim's value to prevent clashes with existing names. + // prefix needs to be set if claim is set and can be the empty string. + // Mutually exclusive with expression. + // +optional + Prefix *string `json:"prefix,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and prefix. + // +optional + Expression string `json:"expression,omitempty"` +} + +// ClaimOrExpression provides the configuration for a single claim or expression. +type ClaimOrExpression struct { + // claim is the JWT claim to use. + // Either claim or expression must be set. + // Mutually exclusive with expression. + // +optional + Claim string `json:"claim,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim. + // +optional + Expression string `json:"expression,omitempty"` +} + +// ExtraMapping provides the configuration for a single extra mapping. +type ExtraMapping struct { + // key is a string to use as the extra attribute key. + // key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid + // subdomain as defined by RFC 1123. All characters trailing the first "/" must + // be valid HTTP Path characters as defined by RFC 3986. + // key must be lowercase. + // Required to be unique. + // +required + Key string `json:"key"` + + // valueExpression is a CEL expression to extract extra attribute value. + // valueExpression must produce a string or string array value. + // "", [], and null values are treated as the extra mapping not being present. + // Empty string values contained within a string array are filtered out. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + ValueExpression string `json:"valueExpression"` +} + +// UserValidationRule provides the configuration for a single user info validation rule. +type UserValidationRule struct { + // expression represents the expression which will be evaluated by CEL. + // Must return true for the validation to pass. + // + // CEL expressions have access to the contents of UserInfo, organized into CEL variable: + // - 'user' - authentication.k8s.io/v1, Kind=UserInfo object + // Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition. + // API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + Expression string `json:"expression"` + + // message customizes the returned error message when rule returns false. + // message is a literal string. + // +optional + Message string `json:"message,omitempty"` +} + +// ExternalClaimsSource provides the configuration for a single external claim source. +type ExternalClaimsSource struct { + // authentication is an optional field that configures how the apiserver authenticates with an external claims source. + // When not specified, anonymous authentication is used. + // +optional + Authentication *Authentication `json:"authentication,omitempty"` + // tls is an optional field that configures the http client TLS + // settings when fetching external claims from this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS `json:"tls,omitempty"` + // url is a required configuration of the URL + // for which the external claims are located. + // +required + URL *SourceURL `json:"url,omitempty"` + // mappings is a required list of the claim + // and response handling expression pairs + // that produces the claims from the external source. + // + // mappings must have at least 1 entry and must not exceed 16 entries. + // Entries must have a unique name across all external claim sources. + // + // WARNING: claims sourced using these mappings will override any claims + // that exist within the token during the claim-to-identity mapping + // process. Use caution when sourcing external claims to avoid unintentionally + // overriding token claims. To help guard against this, sourcing + // external claims can have guard conditions defined in the 'conditions' + // field. + // + // +listType=atomic + // +required + Mappings []SourcedClaimMapping `json:"mappings,omitempty"` + // conditions is an optional list of conditions in + // which claims should attempt to be fetched from this + // external source. + // When omitted or empty, claims are always attempted to be fetched + // from this external source. + // When specified, all conditions must evaluate to 'true' + // before claims are attempted to be fetched from this external source. + // conditions must not exceed 16 entries. + // Entries must have unique expressions. + // +listType=atomic + // +optional + Conditions []ExternalSourceCondition `json:"conditions,omitempty"` +} + +// TLS configures the TLS options that the apiserver uses as a client +// when making a request to the external claim source. +// At least one field must be set when specified. +type TLS struct { + // certificateAuthority is an optional field that configures the certificate authority + // used to validate TLS connections with the external claims source. + // Must not be empty and must be a valid PEM-encoded certificate. + // +optional + CertificateAuthority *string `json:"certificateAuthority,omitempty"` +} + +// Authentication configures how the apiserver should attempt to authenticate +// with an external claims source. +type Authentication struct { + // type is a required field that sets the type of + // authentication method used by the authenticator + // when fetching external claims. + // + // Allowed values are 'RequestProvidedToken' and 'ClientCredential'. + // + // When set to 'RequestProvidedToken', the authenticator will + // use the token provided to the kube-apiserver as part of the + // request to authenticate with the external claims source. + // + // When set to 'ClientCredential', the authenticator will + // use the configured client-id, client-secret, and token endpoint + // to fetch an access token using the OAuth2 client credentials grant + // flow. The fetched access token will then be used to authenticate + // with the external claims source. + // +required + Type *AuthenticationType `json:"type,omitempty"` + + // clientCredential configures the client credentials + // and token endpoint to use to get an access token. + // This field must be set when type is ClientCredential. + // This field must not be set when type is not ClientCredential. + // +optional + ClientCredential *ClientCredentialConfig `json:"clientCredential,omitempty"` +} + +// AuthenticationType is the type of authentication that should be used +// when fetching claims from an external source. +type AuthenticationType string + +const ( + // AuthenticationTypeRequestProvidedToken is an AuthenticationType + // that represents that the token being evaluated for authentication + // should be used for authenticating with the external claims source. + // This is useful for scenarios where a token has multiple audiences + // and scopes so that it can be used to access both the cluster and + // the UserInfo endpoint that contains additional information about the + // user not present in the token. + AuthenticationTypeRequestProvidedToken AuthenticationType = "RequestProvidedToken" + + // AuthenticationTypeClientCredential is an AuthenticationType + // that represents that the authenticator should use the OAuth2 + // client credentials grant flow to obtain an access token for + // authenticating with the external claims source. + // This is useful for scenarios such as fetching user information + // from Microsoft's Graph API where a separate client credential + // is needed to access the API. + AuthenticationTypeClientCredential AuthenticationType = "ClientCredential" +) + +// ClientCredentialConfig configures the client credentials and token endpoint +// to use to get an access token via the OAuth2 client credentials grant flow. +type ClientCredentialConfig struct { + // clientID is the client identifier to use during the OAuth2 client credentials flow. + // clientID must not be an empty string (""). + // clientID must only contain printable ASCII characters. + // +required + ClientID string `json:"clientID,omitempty"` + + // clientSecret is the client secret to use during the OAuth2 client credentials flow. + // clientSecret is the literal string value of the client secret. + // clientSecret must not be an empty string (""). + // clientSecret must only contain printable ASCII characters. + // +required + ClientSecret string `json:"clientSecret,omitempty"` + + // tokenEndpoint is a required URL to query for an access token using + // the client credential OAuth2 flow. + // tokenEndpoint must not be an empty string (""). + // tokenEndpoint must be a valid HTTPS URL. + // tokenEndpoint must have a host and a path. + // tokenEndpoint must not contain query parameters, fragments, + // or user information (e.g., "user:password@host"). + // +required + TokenEndpoint string `json:"tokenEndpoint,omitempty"` + + // scopes is an optional list of OAuth2 scopes to request when obtaining + // an access token. If not specified, the token endpoint's default scopes + // will be used. Each scope must not be an empty string (""). + // +listType=atomic + // +optional + Scopes []string `json:"scopes,omitempty"` + + // tls is an optional field that configures the http client TLS + // settings when fetching an access token for this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS `json:"tls,omitempty"` +} + +// SourceURL configures the options used to build the URL that is queried for external claims. +type SourceURL struct { + // hostname is a required hostname for which the external claims are located. + // It must be a valid DNS subdomain name as per RFC1123. + // This means that it must start and end with a lowercase alphanumeric character, + // must only consist of lowercase alphanumeric characters, '-', and '.'. + // hostname must not be an empty string ("") and must not exceed 253 characters in length. + // hostname may optionally specify a port in the format ':{port}'. + // +required + Hostname *string `json:"hostname,omitempty"` + // pathExpression is a required CEL expression that returns a list + // of string values used to construct the URL path. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + PathExpression *string `json:"pathExpression,omitempty"` +} + +// SourcedClaimMapping configures the mapping behavior for a single external claim +// from the response the apiserver received from the external claim source. +type SourcedClaimMapping struct { + // name is a required name of the claim that + // will be produced and made available during + // the claim-to-identity mapping process. + // name must consist of only lowercase alpha characters and underscores ('_'). + // name must not be an empty string ("") and must not exceed 256 characters in length. + // +required + Name *string `json:"name,omitempty"` + + // expression is a required CEL expression that + // will produce a value to be assigned to the claim. + // The full response body from the request to the + // external claim source is provided via the + // `response` variable. + // expression must not be an empty string (""). + // +required + Expression *string `json:"expression,omitempty"` +} + +// ExternalSourceCondition configures a singular condition +// that must return true before the external source is queried +// to retrieve external claims. +type ExternalSourceCondition struct { + // expression is a required CEL expression that + // is used to determine whether or not an external + // source should be used to fetch external claims. + // The expression must return a boolean value, + // where true means that the source should be consulted + // and false means that it should not. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + Expression *string `json:"expression,omitempty"` +} diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 000000000000..30c73962ba4e --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,406 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by codegen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Authentication) DeepCopyInto(out *Authentication) { + *out = *in + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(AuthenticationType) + **out = **in + } + if in.ClientCredential != nil { + in, out := &in.ClientCredential, &out.ClientCredential + *out = new(ClientCredentialConfig) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication. +func (in *Authentication) DeepCopy() *Authentication { + if in == nil { + return nil + } + out := new(Authentication) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AuthenticationConfiguration) DeepCopyInto(out *AuthenticationConfiguration) { + *out = *in + out.TypeMeta = in.TypeMeta + if in.JWT != nil { + in, out := &in.JWT, &out.JWT + *out = make([]JWTAuthenticator, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationConfiguration. +func (in *AuthenticationConfiguration) DeepCopy() *AuthenticationConfiguration { + if in == nil { + return nil + } + out := new(AuthenticationConfiguration) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AuthenticationConfiguration) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimMappings) DeepCopyInto(out *ClaimMappings) { + *out = *in + in.Username.DeepCopyInto(&out.Username) + in.Groups.DeepCopyInto(&out.Groups) + out.UID = in.UID + if in.Extra != nil { + in, out := &in.Extra, &out.Extra + *out = make([]ExtraMapping, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimMappings. +func (in *ClaimMappings) DeepCopy() *ClaimMappings { + if in == nil { + return nil + } + out := new(ClaimMappings) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimOrExpression) DeepCopyInto(out *ClaimOrExpression) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimOrExpression. +func (in *ClaimOrExpression) DeepCopy() *ClaimOrExpression { + if in == nil { + return nil + } + out := new(ClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimValidationRule) DeepCopyInto(out *ClaimValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimValidationRule. +func (in *ClaimValidationRule) DeepCopy() *ClaimValidationRule { + if in == nil { + return nil + } + out := new(ClaimValidationRule) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClientCredentialConfig) DeepCopyInto(out *ClientCredentialConfig) { + *out = *in + if in.Scopes != nil { + in, out := &in.Scopes, &out.Scopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCredentialConfig. +func (in *ClientCredentialConfig) DeepCopy() *ClientCredentialConfig { + if in == nil { + return nil + } + out := new(ClientCredentialConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalClaimsSource) DeepCopyInto(out *ExternalClaimsSource) { + *out = *in + if in.Authentication != nil { + in, out := &in.Authentication, &out.Authentication + *out = new(Authentication) + (*in).DeepCopyInto(*out) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + if in.URL != nil { + in, out := &in.URL, &out.URL + *out = new(SourceURL) + (*in).DeepCopyInto(*out) + } + if in.Mappings != nil { + in, out := &in.Mappings, &out.Mappings + *out = make([]SourcedClaimMapping, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]ExternalSourceCondition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalClaimsSource. +func (in *ExternalClaimsSource) DeepCopy() *ExternalClaimsSource { + if in == nil { + return nil + } + out := new(ExternalClaimsSource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalSourceCondition) DeepCopyInto(out *ExternalSourceCondition) { + *out = *in + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSourceCondition. +func (in *ExternalSourceCondition) DeepCopy() *ExternalSourceCondition { + if in == nil { + return nil + } + out := new(ExternalSourceCondition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExtraMapping) DeepCopyInto(out *ExtraMapping) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraMapping. +func (in *ExtraMapping) DeepCopy() *ExtraMapping { + if in == nil { + return nil + } + out := new(ExtraMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Issuer) DeepCopyInto(out *Issuer) { + *out = *in + if in.Audiences != nil { + in, out := &in.Audiences, &out.Audiences + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Issuer. +func (in *Issuer) DeepCopy() *Issuer { + if in == nil { + return nil + } + out := new(Issuer) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) { + *out = *in + if in.Issuer != nil { + in, out := &in.Issuer, &out.Issuer + *out = new(Issuer) + (*in).DeepCopyInto(*out) + } + if in.ClaimValidationRules != nil { + in, out := &in.ClaimValidationRules, &out.ClaimValidationRules + *out = make([]ClaimValidationRule, len(*in)) + copy(*out, *in) + } + if in.ClaimMappings != nil { + in, out := &in.ClaimMappings, &out.ClaimMappings + *out = new(ClaimMappings) + (*in).DeepCopyInto(*out) + } + if in.UserValidationRules != nil { + in, out := &in.UserValidationRules, &out.UserValidationRules + *out = make([]UserValidationRule, len(*in)) + copy(*out, *in) + } + if in.ExternalClaimsSources != nil { + in, out := &in.ExternalClaimsSources, &out.ExternalClaimsSources + *out = make([]ExternalClaimsSource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator. +func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator { + if in == nil { + return nil + } + out := new(JWTAuthenticator) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PrefixedClaimOrExpression) DeepCopyInto(out *PrefixedClaimOrExpression) { + *out = *in + if in.Prefix != nil { + in, out := &in.Prefix, &out.Prefix + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrefixedClaimOrExpression. +func (in *PrefixedClaimOrExpression) DeepCopy() *PrefixedClaimOrExpression { + if in == nil { + return nil + } + out := new(PrefixedClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourceURL) DeepCopyInto(out *SourceURL) { + *out = *in + if in.Hostname != nil { + in, out := &in.Hostname, &out.Hostname + *out = new(string) + **out = **in + } + if in.PathExpression != nil { + in, out := &in.PathExpression, &out.PathExpression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceURL. +func (in *SourceURL) DeepCopy() *SourceURL { + if in == nil { + return nil + } + out := new(SourceURL) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourcedClaimMapping) DeepCopyInto(out *SourcedClaimMapping) { + *out = *in + if in.Name != nil { + in, out := &in.Name, &out.Name + *out = new(string) + **out = **in + } + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourcedClaimMapping. +func (in *SourcedClaimMapping) DeepCopy() *SourcedClaimMapping { + if in == nil { + return nil + } + out := new(SourcedClaimMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLS) DeepCopyInto(out *TLS) { + *out = *in + if in.CertificateAuthority != nil { + in, out := &in.CertificateAuthority, &out.CertificateAuthority + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS. +func (in *TLS) DeepCopy() *TLS { + if in == nil { + return nil + } + out := new(TLS) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *UserValidationRule) DeepCopyInto(out *UserValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserValidationRule. +func (in *UserValidationRule) DeepCopy() *UserValidationRule { + if in == nil { + return nil + } + out := new(UserValidationRule) + in.DeepCopyInto(out) + return out +} diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.model_name.go new file mode 100644 index 000000000000..634c691fc75e --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.model_name.go @@ -0,0 +1,86 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by codegen. DO NOT EDIT. + +package v1alpha1 + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in Authentication) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.Authentication" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in AuthenticationConfiguration) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.AuthenticationConfiguration" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ClaimMappings) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ClaimMappings" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ClaimOrExpression) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ClaimOrExpression" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ClaimValidationRule) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ClaimValidationRule" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ClientCredentialConfig) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ClientCredentialConfig" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ExternalClaimsSource) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ExternalClaimsSource" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ExternalSourceCondition) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ExternalSourceCondition" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ExtraMapping) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.ExtraMapping" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in Issuer) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.Issuer" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in JWTAuthenticator) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.JWTAuthenticator" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in PrefixedClaimOrExpression) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.PrefixedClaimOrExpression" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in SourceURL) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.SourceURL" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in SourcedClaimMapping) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.SourcedClaimMapping" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TLS) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.TLS" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in UserValidationRule) OpenAPIModelName() string { + return "com.github.openshift.api.authentication.v1alpha1.UserValidationRule" +} diff --git a/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.swagger_doc_generated.go new file mode 100644 index 000000000000..12337dddcab4 --- /dev/null +++ b/vendor/github.com/openshift/api/authentication/v1alpha1/zz_generated.swagger_doc_generated.go @@ -0,0 +1,189 @@ +package v1alpha1 + +// This file contains a collection of methods that can be used from go-restful to +// generate Swagger API documentation for its models. Please read this PR for more +// information on the implementation: https://github.com/emicklei/go-restful/pull/215 +// +// TODOs are ignored from the parser (e.g. TODO(andronat):... || TODO:...) if and only if +// they are on one line! For multiple line or blocks that you want to ignore use ---. +// Any context after a --- is ignored. +// +// Those methods can be generated by using hack/update-swagger-docs.sh + +// AUTO-GENERATED FUNCTIONS START HERE +var map_Authentication = map[string]string{ + "": "Authentication configures how the apiserver should attempt to authenticate with an external claims source.", + "type": "type is a required field that sets the type of authentication method used by the authenticator when fetching external claims.\n\nAllowed values are 'RequestProvidedToken' and 'ClientCredential'.\n\nWhen set to 'RequestProvidedToken', the authenticator will use the token provided to the kube-apiserver as part of the request to authenticate with the external claims source.\n\nWhen set to 'ClientCredential', the authenticator will use the configured client-id, client-secret, and token endpoint to fetch an access token using the OAuth2 client credentials grant flow. The fetched access token will then be used to authenticate with the external claims source.", + "clientCredential": "clientCredential configures the client credentials and token endpoint to use to get an access token. This field must be set when type is ClientCredential. This field must not be set when type is not ClientCredential.", +} + +func (Authentication) SwaggerDoc() map[string]string { + return map_Authentication +} + +var map_AuthenticationConfiguration = map[string]string{ + "": "AuthenticationConfiguration is the configuration-file API read by the oauth-apiserver when it runs in External OIDC mode.\n\nThe cluster-authentication-operator is the only component that writes this configuration file. It generates the file from the user-facing config.openshift.io/v1, Kind=Authentication API. This type is not a CRD and must not be configured directly.\n\nThe oauth-apiserver performs semantic validation when it reads this file. See https://github.com/openshift/oauth-apiserver/blob/97a820bd5412/pkg/externaloidc/apis/authentication/validation/validation.go.\n\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", + "trustedCAFilePath": "trustedCAFilePath is an optional path to a PEM-encoded CA bundle used to verify outbound HTTPS connections including proxies and TLS-intercepting proxies for outbound issuer discovery and JWKS requests. When specified, the file is watched and updates are applied without restarting the webhook server. When omitted, connections use the system trust roots only.", + "jwt": "jwt is a list of authenticator to authenticate Kubernetes users using JWT compliant tokens. The authenticator will attempt to parse a raw ID token, verify it's been signed by the configured issuer. The public key to verify the signature is discovered from the issuer's public endpoint using OIDC discovery. For an incoming token, each JWT authenticator will be attempted in the order in which it is specified in this list. Note however that other authenticators may run before or after the JWT authenticators. The specific position of JWT authenticators in relation to other authenticators is neither defined nor stable across releases. Since each JWT authenticator must have a unique issuer URL, at most one JWT authenticator will attempt to cryptographically validate the token.\n\nThe minimum valid JWT payload must contain the following claims: {\n\t\t\"iss\": \"https://issuer.example.com\",\n\t\t\"aud\": [\"audience\"],\n\t\t\"exp\": 1234567890,\n\t\t\"\": \"username\"\n}", +} + +func (AuthenticationConfiguration) SwaggerDoc() map[string]string { + return map_AuthenticationConfiguration +} + +var map_ClaimMappings = map[string]string{ + "": "ClaimMappings provides the configuration for claim mapping", + "username": "username represents an option for the username attribute. The claim's value must be a singular string. Same as the --oidc-username-claim and --oidc-username-prefix flags. If username.expression is set, the expression must produce a string value. If username.expression uses 'claims.email', then 'claims.email_verified' must be used in username.expression or extra[*].valueExpression or claimValidationRules[*].expression. An example claim validation rule expression that matches the validation automatically applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified claim will be caught at runtime.\n\nIn the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, the default value is \"sub\". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly. For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim=\"sub\" in the authentication config. For prefix:\n (1) --oidc-username-prefix=\"-\", no prefix was added to the username. For the same behavior using authentication config,\n set username.prefix=\"\"\n (2) --oidc-username-prefix=\"\" and --oidc-username-claim != \"email\", prefix was \"#\". For the same\n behavior using authentication config, set username.prefix=\"#\"\n (3) --oidc-username-prefix=\"\". For the same behavior using authentication config, set username.prefix=\"\"", + "groups": "groups represents an option for the groups attribute. The claim's value must be a string or string array claim. If groups.claim is set, the prefix must be specified (and can be the empty string). If groups.expression is set, the expression must produce a string or string array value.\n \"\", [], and null values are treated as the group mapping not being present.", + "uid": "uid represents an option for the uid attribute. Claim must be a singular string claim. If uid.expression is set, the expression must produce a string value.", + "extra": "extra represents an option for the extra attribute. expression must produce a string or string array value. If the value is empty, the extra mapping will not be present.\n\nhard-coded extra key/value - key: \"foo\"\n valueExpression: \"'bar'\"\nThis will result in an extra attribute - foo: [\"bar\"]\n\nhard-coded key, value copying claim value - key: \"foo\"\n valueExpression: \"claims.some_claim\"\nThis will result in an extra attribute - foo: [value of some_claim]\n\nhard-coded key, value derived from claim value - key: \"admin\"\n valueExpression: '(has(claims.is_admin) && claims.is_admin) ? \"true\":\"\"'\nThis will result in:\n - if is_admin claim is present and true, extra attribute - admin: [\"true\"]\n - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added", +} + +func (ClaimMappings) SwaggerDoc() map[string]string { + return map_ClaimMappings +} + +var map_ClaimOrExpression = map[string]string{ + "": "ClaimOrExpression provides the configuration for a single claim or expression.", + "claim": "claim is the JWT claim to use. Either claim or expression must be set. Mutually exclusive with expression.", + "expression": "expression represents the expression which will be evaluated by CEL.\n\nCEL expressions have access to the contents of the token claims, organized into CEL variable: - 'claims' is a map of claim names to claim values.\n For example, a variable named 'sub' can be accessed as 'claims.sub'.\n Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.\n\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nMutually exclusive with claim.", +} + +func (ClaimOrExpression) SwaggerDoc() map[string]string { + return map_ClaimOrExpression +} + +var map_ClaimValidationRule = map[string]string{ + "": "ClaimValidationRule provides the configuration for a single claim validation rule.", + "claim": "claim is the name of a required claim. Same as --oidc-required-claim flag. Only string claim keys are supported. Mutually exclusive with expression and message.", + "requiredValue": "requiredValue is the value of a required claim. Same as --oidc-required-claim flag. Only string claim values are supported. If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string. Mutually exclusive with expression and message.", + "expression": "expression represents the expression which will be evaluated by CEL. Must produce a boolean.\n\nCEL expressions have access to the contents of the token claims, organized into CEL variable: - 'claims' is a map of claim names to claim values.\n For example, a variable named 'sub' can be accessed as 'claims.sub'.\n Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.\nMust return true for the validation to pass.\n\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nMutually exclusive with claim and requiredValue.", + "message": "message customizes the returned error message when expression returns false. message is a literal string. Mutually exclusive with claim and requiredValue.", +} + +func (ClaimValidationRule) SwaggerDoc() map[string]string { + return map_ClaimValidationRule +} + +var map_ClientCredentialConfig = map[string]string{ + "": "ClientCredentialConfig configures the client credentials and token endpoint to use to get an access token via the OAuth2 client credentials grant flow.", + "clientID": "clientID is the client identifier to use during the OAuth2 client credentials flow. clientID must not be an empty string (\"\"). clientID must only contain printable ASCII characters.", + "clientSecret": "clientSecret is the client secret to use during the OAuth2 client credentials flow. clientSecret is the literal string value of the client secret. clientSecret must not be an empty string (\"\"). clientSecret must only contain printable ASCII characters.", + "tokenEndpoint": "tokenEndpoint is a required URL to query for an access token using the client credential OAuth2 flow. tokenEndpoint must not be an empty string (\"\"). tokenEndpoint must be a valid HTTPS URL. tokenEndpoint must have a host and a path. tokenEndpoint must not contain query parameters, fragments, or user information (e.g., \"user:password@host\").", + "scopes": "scopes is an optional list of OAuth2 scopes to request when obtaining an access token. If not specified, the token endpoint's default scopes will be used. Each scope must not be an empty string (\"\").", + "tls": "tls is an optional field that configures the http client TLS settings when fetching an access token for this source. At least one subfield must be set when this field is specified.", +} + +func (ClientCredentialConfig) SwaggerDoc() map[string]string { + return map_ClientCredentialConfig +} + +var map_ExternalClaimsSource = map[string]string{ + "": "ExternalClaimsSource provides the configuration for a single external claim source.", + "authentication": "authentication is an optional field that configures how the apiserver authenticates with an external claims source. When not specified, anonymous authentication is used.", + "tls": "tls is an optional field that configures the http client TLS settings when fetching external claims from this source. At least one subfield must be set when this field is specified.", + "url": "url is a required configuration of the URL for which the external claims are located.", + "mappings": "mappings is a required list of the claim and response handling expression pairs that produces the claims from the external source.\n\nmappings must have at least 1 entry and must not exceed 16 entries. Entries must have a unique name across all external claim sources.\n\nWARNING: claims sourced using these mappings will override any claims that exist within the token during the claim-to-identity mapping process. Use caution when sourcing external claims to avoid unintentionally overriding token claims. To help guard against this, sourcing external claims can have guard conditions defined in the 'conditions' field.", + "conditions": "conditions is an optional list of conditions in which claims should attempt to be fetched from this external source. When omitted or empty, claims are always attempted to be fetched from this external source. When specified, all conditions must evaluate to 'true' before claims are attempted to be fetched from this external source. conditions must not exceed 16 entries. Entries must have unique expressions.", +} + +func (ExternalClaimsSource) SwaggerDoc() map[string]string { + return map_ExternalClaimsSource +} + +var map_ExternalSourceCondition = map[string]string{ + "": "ExternalSourceCondition configures a singular condition that must return true before the external source is queried to retrieve external claims.", + "expression": "expression is a required CEL expression that is used to determine whether or not an external source should be used to fetch external claims. The expression must return a boolean value, where true means that the source should be consulted and false means that it should not. Claims from the token used for the request to the kube-apiserver are made available via the `claims` variable. expression must not be an empty string (\"\").", +} + +func (ExternalSourceCondition) SwaggerDoc() map[string]string { + return map_ExternalSourceCondition +} + +var map_ExtraMapping = map[string]string{ + "": "ExtraMapping provides the configuration for a single extra mapping.", + "key": "key is a string to use as the extra attribute key. key must be a domain-prefix path (e.g. example.org/foo). All characters before the first \"/\" must be a valid subdomain as defined by RFC 1123. All characters trailing the first \"/\" must be valid HTTP Path characters as defined by RFC 3986. key must be lowercase. Required to be unique.", + "valueExpression": "valueExpression is a CEL expression to extract extra attribute value. valueExpression must produce a string or string array value. \"\", [], and null values are treated as the extra mapping not being present. Empty string values contained within a string array are filtered out.\n\nCEL expressions have access to the contents of the token claims, organized into CEL variable: - 'claims' is a map of claim names to claim values.\n For example, a variable named 'sub' can be accessed as 'claims.sub'.\n Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.\n\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/", +} + +func (ExtraMapping) SwaggerDoc() map[string]string { + return map_ExtraMapping +} + +var map_Issuer = map[string]string{ + "": "Issuer provides the configuration for an external provider's specific settings.", + "url": "url points to the issuer URL in a format https://url or https://url/path. This must match the \"iss\" claim in the presented JWT, and the issuer returned from discovery. Same value as the --oidc-issuer-url flag. Discovery information is fetched from \"{url}/.well-known/openid-configuration\" unless overridden by discoveryURL. Required to be unique across all JWT authenticators. Note that egress selection configuration is not used for this network connection.", + "discoveryURL": "discoveryURL, if specified, overrides the URL used to fetch discovery information instead of using \"{url}/.well-known/openid-configuration\". The exact value specified is used, so \"/.well-known/openid-configuration\" must be included in discoveryURL if needed.\n\nThe \"issuer\" field in the fetched discovery information must match the \"issuer.url\" field in the AuthenticationConfiguration and will be used to validate the \"iss\" claim in the presented JWT. This is for scenarios where the well-known and jwks endpoints are hosted at a different location than the issuer (such as locally in the cluster).\n\nExample: A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace' and discovery information is available at '/.well-known/openid-configuration'. discoveryURL: \"https://oidc.oidc-namespace/.well-known/openid-configuration\" certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate must be set to 'oidc.oidc-namespace'.\n\ncurl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field) {\n issuer: \"https://oidc.example.com\" (.url field)\n}\n\ndiscoveryURL must be different from url. Required to be unique across all JWT authenticators. Note that egress selection configuration is not used for this network connection.", + "certificateAuthority": "certificateAuthority contains PEM-encoded certificate authority certificates used to validate the connection when fetching discovery information. If unset, the system verifier is used. Same value as the content of the file referenced by the --oidc-ca-file flag.", + "audiences": "audiences is the set of acceptable audiences the JWT must be issued to. At least one of the entries must match the \"aud\" claim in presented JWTs. Same value as the --oidc-client-id flag (though this field supports an array). Required to be non-empty.", + "audienceMatchPolicy": "audienceMatchPolicy defines how the \"audiences\" field is used to match the \"aud\" claim in the presented JWT. Allowed values are: 1. \"MatchAny\" when multiple audiences are specified and 2. empty (or unset) or \"MatchAny\" when a single audience is specified.\n\n- MatchAny: the \"aud\" claim in the presented JWT must match at least one of the entries in the \"audiences\" field. For example, if \"audiences\" is [\"foo\", \"bar\"], the \"aud\" claim in the presented JWT must contain either \"foo\" or \"bar\" (and may contain both).\n\n- \"\": The match policy can be empty (or unset) when a single audience is specified in the \"audiences\" field. The \"aud\" claim in the presented JWT must contain the single audience (and may contain others).\n\nFor more nuanced audience validation, use claimValidationRules.\n example: claimValidationRule[].expression: 'sets.equivalent(claims.aud, [\"bar\", \"foo\", \"baz\"])' to require an exact match.", +} + +func (Issuer) SwaggerDoc() map[string]string { + return map_Issuer +} + +var map_JWTAuthenticator = map[string]string{ + "": "JWTAuthenticator configures one JWT authenticator.", + "issuer": "issuer contains the basic OIDC provider connection options.", + "claimValidationRules": "claimValidationRules are rules that are applied to validate token claims to authenticate users.", + "claimMappings": "claimMappings points claims of a token to be treated as user attributes.", + "userValidationRules": "userValidationRules are rules that are applied to final user before completing authentication. These allow invariants to be applied to incoming identities such as preventing the use of the system: prefix that is commonly used by Kubernetes components. The validation rules are logically ANDed together and must all return true for the validation to pass.", + "externalClaimsSources": "externalClaimsSources is an optional field that can be used to configure sources, external to the token provided in a request, in which claims should be fetched from and made available to the claim mapping process that is used to build the identity of a token holder. For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint. externalClaimsSources must not exceed 5 entries.", +} + +func (JWTAuthenticator) SwaggerDoc() map[string]string { + return map_JWTAuthenticator +} + +var map_PrefixedClaimOrExpression = map[string]string{ + "": "PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression.", + "claim": "claim is the JWT claim to use. Mutually exclusive with expression.", + "prefix": "prefix is prepended to claim's value to prevent clashes with existing names. prefix needs to be set if claim is set and can be the empty string. Mutually exclusive with expression.", + "expression": "expression represents the expression which will be evaluated by CEL.\n\nCEL expressions have access to the contents of the token claims, organized into CEL variable: - 'claims' is a map of claim names to claim values.\n For example, a variable named 'sub' can be accessed as 'claims.sub'.\n Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.\n\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/\n\nMutually exclusive with claim and prefix.", +} + +func (PrefixedClaimOrExpression) SwaggerDoc() map[string]string { + return map_PrefixedClaimOrExpression +} + +var map_SourceURL = map[string]string{ + "": "SourceURL configures the options used to build the URL that is queried for external claims.", + "hostname": "hostname is a required hostname for which the external claims are located. It must be a valid DNS subdomain name as per RFC1123. This means that it must start and end with a lowercase alphanumeric character, must only consist of lowercase alphanumeric characters, '-', and '.'. hostname must not be an empty string (\"\") and must not exceed 253 characters in length. hostname may optionally specify a port in the format ':{port}'.", + "pathExpression": "pathExpression is a required CEL expression that returns a list of string values used to construct the URL path. Claims from the token used for the request to the kube-apiserver are made available via the `claims` variable. expression must not be an empty string (\"\").", +} + +func (SourceURL) SwaggerDoc() map[string]string { + return map_SourceURL +} + +var map_SourcedClaimMapping = map[string]string{ + "": "SourcedClaimMapping configures the mapping behavior for a single external claim from the response the apiserver received from the external claim source.", + "name": "name is a required name of the claim that will be produced and made available during the claim-to-identity mapping process. name must consist of only lowercase alpha characters and underscores ('_'). name must not be an empty string (\"\") and must not exceed 256 characters in length.", + "expression": "expression is a required CEL expression that will produce a value to be assigned to the claim. The full response body from the request to the external claim source is provided via the `response` variable. expression must not be an empty string (\"\").", +} + +func (SourcedClaimMapping) SwaggerDoc() map[string]string { + return map_SourcedClaimMapping +} + +var map_TLS = map[string]string{ + "": "TLS configures the TLS options that the apiserver uses as a client when making a request to the external claim source. At least one field must be set when specified.", + "certificateAuthority": "certificateAuthority is an optional field that configures the certificate authority used to validate TLS connections with the external claims source. Must not be empty and must be a valid PEM-encoded certificate.", +} + +func (TLS) SwaggerDoc() map[string]string { + return map_TLS +} + +var map_UserValidationRule = map[string]string{ + "": "UserValidationRule provides the configuration for a single user info validation rule.", + "expression": "expression represents the expression which will be evaluated by CEL. Must return true for the validation to pass.\n\nCEL expressions have access to the contents of UserInfo, organized into CEL variable: - 'user' - authentication.k8s.io/v1, Kind=UserInfo object\n Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.\n API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io\n\nDocumentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/", + "message": "message customizes the returned error message when rule returns false. message is a literal string.", +} + +func (UserValidationRule) SwaggerDoc() map[string]string { + return map_UserValidationRule +} + +// AUTO-GENERATED FUNCTIONS END HERE diff --git a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go index 9cb85f4c0033..d7097f904dc1 100644 --- a/vendor/github.com/openshift/api/config/v1/types_cluster_version.go +++ b/vendor/github.com/openshift/api/config/v1/types_cluster_version.go @@ -18,8 +18,8 @@ import ( // +kubebuilder:object:root=true // +kubebuilder:subresource:status // +kubebuilder:resource:path=clusterversions,scope=Cluster -// +openshift:validation:FeatureGateAwareXValidation:featureGate="";CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" -// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" +// +openshift:validation:FeatureGateAwareXValidation:featureGate="";CRDCompatibilityRequirementOperator,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && self.spec.capabilities.baselineCapabilitySet == 'None' && 'marketplace' in self.spec.capabilities.additionalEnabledCapabilities ? 'OperatorLifecycleManager' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'OperatorLifecycleManager' in self.status.capabilities.enabledCapabilities) : true",message="the `marketplace` capability requires the `OperatorLifecycleManager` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `OperatorLifecycleManager` capability" +// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIOperator,rule="has(self.spec.capabilities) && has(self.spec.capabilities.additionalEnabledCapabilities) && 'ClusterAPI' in self.spec.capabilities.additionalEnabledCapabilities ? 'CompatibilityRequirements' in self.spec.capabilities.additionalEnabledCapabilities || (has(self.status) && has(self.status.capabilities) && has(self.status.capabilities.enabledCapabilities) && 'CompatibilityRequirements' in self.status.capabilities.enabledCapabilities) : true",message="the `ClusterAPI` capability requires the `CompatibilityRequirements` capability, which is neither explicitly or implicitly enabled in this cluster, please enable the `CompatibilityRequirements` capability" // +kubebuilder:printcolumn:name=Version,JSONPath=.status.history[?(@.state=="Completed")].version,type=string // +kubebuilder:printcolumn:name=Available,JSONPath=.status.conditions[?(@.type=="Available")].status,type=string // +kubebuilder:printcolumn:name=Progressing,JSONPath=.status.conditions[?(@.type=="Progressing")].status,type=string @@ -307,8 +307,7 @@ const ( // ClusterVersionCapability enumerates optional, core cluster components. // +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1 // +openshift:validation:FeatureGateAwareEnum:featureGate=CRDCompatibilityRequirementOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements -// +openshift:validation:FeatureGateAwareEnum:featureGate=ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI -// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIMachineManagement,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI +// +openshift:validation:FeatureGateAwareEnum:requiredFeatureGate=CRDCompatibilityRequirementOperator;ClusterAPIOperator,enum=openshift-samples;baremetal;marketplace;Console;Insights;Storage;CSISnapshot;NodeTuning;MachineAPI;Build;DeploymentConfig;ImageRegistry;OperatorLifecycleManager;CloudCredential;Ingress;CloudControllerManager;OperatorLifecycleManagerV1;CompatibilityRequirements;ClusterAPI type ClusterVersionCapability string const ( diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go index 857f9b27929b..a0375adff819 100644 --- a/vendor/github.com/openshift/api/config/v1/types_infrastructure.go +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure.go @@ -71,6 +71,22 @@ type InfrastructureSpec struct { // +kubebuilder:validation:Enum=HighlyAvailable;SingleReplica // +optional ControlPlaneTopology TopologyMode `json:"controlPlaneTopology,omitempty"` + + // infrastructureTopology expresses the desired topology for infrastructure + // services that do not run on control plane nodes, indicating how + // infrastructure workloads are distributed across nodes. + // + // When omitted, no topology transition override has been expressed. + // Once populated, the field represents the desired topology state. + // + // When the value differs from status.infrastructureTopology, the cluster + // evaluates whether the requested transition can proceed. Not all + // transitions may be permitted. + // + // +openshift:enable:FeatureGate=MutableTopology + // +kubebuilder:validation:Enum=HighlyAvailable;SingleReplica + // +optional + InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` } // InfrastructureStatus describes the infrastructure the cluster is leveraging. @@ -138,6 +154,16 @@ type InfrastructureStatus struct { // +optional InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` + // topologyTransitionStatus reports evaluations of supported topology transitions + // and the status of a requested transition, if any. + // It is optional and is omitted until the topology controller reports transition status. + // A transition is requested through spec.controlPlaneTopology. The controller + // reports completion only after both topologies reach that transition's target + // and post-transition checks pass; reaching the target topology alone is not completion. + // +openshift:enable:FeatureGate=MutableTopology + // +optional + TopologyTransitionStatus TopologyTransitionStatus `json:"topologyTransitionStatus,omitzero"` + // cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. // CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. // Valid values are "None" and "AllNodes". When omitted, the default value is "None". diff --git a/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go b/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go new file mode 100644 index 000000000000..113d3b211636 --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1/types_infrastructure_transitions.go @@ -0,0 +1,170 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// TopologyState describes the control-plane and infrastructure topology at one +// end of a topology transition. +// The topology controller determines which transitions are supported. Currently, +// it supports only transitions that change both topologies from SingleReplica to +// HighlyAvailable. Representing a topology here does not enable a transition to it. +type TopologyState struct { + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. HighlyAvailable means multiple instances are expected + // to provide redundancy. HighlyAvailableArbiter means two control-plane nodes + // and a smaller arbiter node to maintain quorum. + // See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for + // topology definitions. + // controlPlaneTopology is required. + // +kubebuilder:validation:Enum=HighlyAvailable;HighlyAvailableArbiter;SingleReplica + // +required + ControlPlaneTopology TopologyMode `json:"controlPlaneTopology,omitempty"` + + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // infrastructureTopology is required. + // +kubebuilder:validation:Enum=SingleReplica;HighlyAvailable + // +required + InfrastructureTopology TopologyMode `json:"infrastructureTopology,omitempty"` +} + +const ( + // TopologyTransitionsEvaluatedConditionType indicates whether supported transition types have been evaluated. + // + // The controller always reports this condition when topologyTransitionStatus is + // set. It reports Unknown before evaluation and while checks are being refreshed, + // True when evaluation finishes successfully (even if no transitions are supported + // or available), and False when evaluation cannot finish. It retains the last + // results while refreshing checks or reporting an evaluation failure. Clients + // must treat those results as stale unless this condition is True. + TopologyTransitionsEvaluatedConditionType = "TopologyTransitionsEvaluated" + + // TopologyTransitionCompletedConditionType indicates the status of the current or most recent transition. + // + // The controller always reports this condition when topologyTransitionStatus is + // set. It reports Unknown before a transition is requested, True after both + // topologies reach the requested transition's target and post-transition checks + // pass, and False while the transition is in progress or blocked. + // Reaching the target topology alone does not mean the transition is complete: + // this condition remains False while post-transition checks are pending or failing. + TopologyTransitionCompletedConditionType = "TopologyTransitionCompleted" + + // TopologyTransitionAvailableConditionType indicates if a type of transition is available based on + // the most recently evaluated state of the cluster. + // + // TopologyTransitionAvailableConditionType is Unknown before evaluation, True when evaluations + // for the given transition succeed, and False when one or more evaluations for a transition fail. + // Because the controller clears transitions whenever TopologyTransitionsEvaluated is not True, + // a reported value always reflects the current evaluation, never a stale one. + TopologyTransitionAvailableConditionType = "TopologyTransitionAvailable" +) + +// TopologyTransitionStatus reports availability of each type of topology transition and contains the +// status of any initiated transition. +// +kubebuilder:validation:MinProperties=1 +type TopologyTransitionStatus struct { + // conditions provides information on topology transition progress and the + // evaluation of supported transition types. The controller always reports both + // conditions once topologyTransitionStatus is set. + // + // Valid condition types are TopologyTransitionsEvaluated and + // TopologyTransitionCompleted. Both conditions must be present: the controller + // always reports each condition explicitly, using Unknown when a condition's + // state is not yet known, rather than omitting it. + // + // +kubebuilder:validation:MinItems=2 + // +kubebuilder:validation:MaxItems=2 + // +kubebuilder:validation:XValidation:rule="self.all(c, c.type in ['TopologyTransitionsEvaluated', 'TopologyTransitionCompleted'])",message="conditions may only contain TopologyTransitionsEvaluated and TopologyTransitionCompleted" + // +optional + // +listType=map + // +listMapKey=type + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // transitions contains each supported transition type and its availability. + // It is optional. The controller clears this list whenever + // TopologyTransitionsEvaluated is not True, so its presence always reflects + // current, trustworthy results: an omitted list while TopologyTransitionsEvaluated + // is True means no supported transition options were found, and an omitted list + // otherwise means no transition options have been reported yet. + // + // Between one and eight transition options must be present when the list is set. + // This list reports transition options, not concurrent transitions. The topology + // controller determines which transition options are supported. + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=8 + // +optional + // +listType=atomic + Transitions []TopologyTransition `json:"transitions,omitempty"` +} + +type TopologyTransition struct { + // source is the control-plane and infrastructure topology this transition was + // evaluated from. It may differ from the current topology while status is + // being refreshed. External control planes cannot be a transition source. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // source is required. + // +required + Source TopologyState `json:"source,omitempty,omitzero"` + + // target is the control-plane and infrastructure topology this transition would + // move to. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // External control planes cannot be a transition target. + // target is required. + // +required + Target TopologyState `json:"target,omitempty,omitzero"` + + // evaluations contains the availability condition for this transition and + // conditions for the checks run against the cluster to determine availability. + // + // TopologyTransitionAvailable is required; other condition types report + // individual checks. Between one and 32 conditions must be present, allowing + // at most 31 individual checks in addition to the availability condition. + // The controller defines individual check types, reasons, and messages, and + // always reports each one explicitly, using Unknown when a check's result is + // not yet known. + // + // +kubebuilder:validation:MaxItems=32 + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:XValidation:rule="self.exists(c, c.type == 'TopologyTransitionAvailable')",message="evaluations must contain TopologyTransitionAvailable" + // +required + // +listType=map + // +listMapKey=type + Evaluations []metav1.Condition `json:"evaluations,omitempty"` +} diff --git a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go index e2f94ae1f37d..1511d149cf36 100644 --- a/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/config/v1/types_kmsencryption.go @@ -2,25 +2,29 @@ package v1 // KMSPluginConfig defines the configuration for the KMS instance // that will be used with KMS encryption -// +kubebuilder:validation:XValidation:rule="self.type == 'Vault' ? has(self.vault) : !has(self.vault)",message="vault config is required when kms provider type is Vault, and forbidden otherwise" -// +union type KMSPluginConfig struct { - // type defines the kind of platform for the KMS provider. - // Allowed values are Vault. - // When set to Vault, the plugin connects to a HashiCorp Vault server for key management. + // --- TOMBSTONE --- + // type was the kind of platform for the KMS provider. + // The field has been replaced by the provider-specific pluginConfig resource. + // The field name is reserved to prevent reuse. // - // +unionDiscriminator // +required - Type KMSProviderType `json:"type"` + // Type KMSProviderType `json:"type"` - // vault defines the configuration for the Vault KMS plugin. - // The plugin connects to a Vault Enterprise server that is managed - // by the user outside the purview of the control plane. - // This field must be set when type is Vault, and must be unset otherwise. + // pluginConfig is a required reference to a cluster-scoped resource with a status subresource + // that satisfies the OpenShift KMS plugin configuration status interface. + // + // +required + PluginConfig KMSPluginConfigReference `json:"pluginConfig,omitzero"` + + // --- TOMBSTONE --- + // vault defined inline Vault-specific KMS plugin configuration. + // It has been replaced by pluginConfig which references a provider-managed custom resource. + // The field name is reserved to prevent reuse. // // +unionMember // +optional - Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"` + // Vault VaultKMSPluginConfig `json:"vault,omitempty,omitzero"` // --- TOMBSTONE --- // aws was a field that allowed configuring AWS KMS. @@ -31,6 +35,43 @@ type KMSPluginConfig struct { // AWS *AWSKMSConfig `json:"aws,omitempty"` } +// KMSPluginConfigReference identifies a cluster-scoped KMS plugin configuration custom resource. +type KMSPluginConfigReference struct { + // apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. + // The value must be in the format /, where group is a DNS subdomain + // and version is a Kubernetes API version (for example, v1 or v1alpha1). + // It must contain between 1 and 64 characters. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=64 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)+/v[0-9]+([a-z0-9]+)*$')",message="apiVersion must be in the format /" + // +required + APIVersion string `json:"apiVersion,omitempty"` + + // resource is required and is the resource name of the referenced KMS plugin configuration custom resource. + // This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), + // not the Kind (for example, VaultKMSConfig). + // The value must be between 1 and 63 characters, contain only lowercase alphanumeric + // characters or '-', and start and end with an alphanumeric character. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=63 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?$')",message="resource must be a valid Kubernetes resource name: contain no more than 63 characters, contain only lowercase alphanumeric characters or '-', and start and end with an alphanumeric character" + // +required + Resource string `json:"resource,omitempty"` + + // name is required and is the metadata.name of the referenced KMS plugin configuration resource. + // The referenced resource must be cluster-scoped. + // The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, + // contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character. + // + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="self.matches('^[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?(\\\\.[a-z0-9]([a-z0-9\\\\-]*[a-z0-9])?)*$')",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +required + Name string `json:"name,omitempty"` +} + // --- TOMBSTONE --- // AWSKMSConfig was a type for AWS KMS configuration that was never implemented. // The type name is reserved to prevent reuse. diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go index 5df50e2f60d0..cf71d7a1d53e 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.go @@ -3820,6 +3820,7 @@ func (in *InfrastructureStatus) DeepCopyInto(out *InfrastructureStatus) { *out = new(PlatformStatus) (*in).DeepCopyInto(*out) } + in.TopologyTransitionStatus.DeepCopyInto(&out.TopologyTransitionStatus) return } @@ -4065,7 +4066,7 @@ func (in *IntermediateTLSProfile) DeepCopy() *IntermediateTLSProfile { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KMSPluginConfig) DeepCopyInto(out *KMSPluginConfig) { *out = *in - out.Vault = in.Vault + out.PluginConfig = in.PluginConfig return } @@ -4079,6 +4080,22 @@ func (in *KMSPluginConfig) DeepCopy() *KMSPluginConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *KMSPluginConfigReference) DeepCopyInto(out *KMSPluginConfigReference) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSPluginConfigReference. +func (in *KMSPluginConfigReference) DeepCopy() *KMSPluginConfigReference { + if in == nil { + return nil + } + out := new(KMSPluginConfigReference) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *KeystoneIdentityProvider) DeepCopyInto(out *KeystoneIdentityProvider) { *out = *in @@ -6853,6 +6870,77 @@ func (in *TokenUserValidationRule) DeepCopy() *TokenUserValidationRule { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyState) DeepCopyInto(out *TopologyState) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyState. +func (in *TopologyState) DeepCopy() *TopologyState { + if in == nil { + return nil + } + out := new(TopologyState) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyTransition) DeepCopyInto(out *TopologyTransition) { + *out = *in + out.Source = in.Source + out.Target = in.Target + if in.Evaluations != nil { + in, out := &in.Evaluations, &out.Evaluations + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyTransition. +func (in *TopologyTransition) DeepCopy() *TopologyTransition { + if in == nil { + return nil + } + out := new(TopologyTransition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TopologyTransitionStatus) DeepCopyInto(out *TopologyTransitionStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Transitions != nil { + in, out := &in.Transitions, &out.Transitions + *out = make([]TopologyTransition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopologyTransitionStatus. +func (in *TopologyTransitionStatus) DeepCopy() *TopologyTransitionStatus { + if in == nil { + return nil + } + out := new(TopologyTransitionStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Update) DeepCopyInto(out *Update) { *out = *in diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml index 09c8665a8f2f..f4162097dfa9 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml @@ -166,8 +166,7 @@ clusterversions.config.openshift.io: Category: "" FeatureGates: - CRDCompatibilityRequirementOperator - - CRDCompatibilityRequirementOperator+ClusterAPIMachineManagement - - ClusterAPIMachineManagement + - CRDCompatibilityRequirementOperator+ClusterAPIOperator - ClusterUpdateAcceptRisks - ClusterUpdatePreflight - ImageStreamImportMode diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go index 043c03ef5efb..c10808e7a8e8 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go @@ -870,6 +870,11 @@ func (in KMSPluginConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.KMSPluginConfig" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in KMSPluginConfigReference) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.KMSPluginConfigReference" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in KeystoneIdentityProvider) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.KeystoneIdentityProvider" @@ -1455,6 +1460,21 @@ func (in TokenUserValidationRule) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.TokenUserValidationRule" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyState) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyState" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyTransition) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyTransition" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in TopologyTransitionStatus) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1.TopologyTransitionStatus" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in Update) OpenAPIModelName() string { return "com.github.openshift.api.config.v1.Update" diff --git a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go index aa7c2ee88215..7fb77382adc4 100644 --- a/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go @@ -1871,10 +1871,11 @@ func (InfrastructureList) SwaggerDoc() map[string]string { } var map_InfrastructureSpec = map[string]string{ - "": "InfrastructureSpec contains settings that apply to the cluster infrastructure.", - "cloudConfig": "cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file. This configuration file is used to configure the Kubernetes cloud provider integration when using the built-in cloud provider integration or the external cloud controller manager. The namespace for this config map is openshift-config.\n\ncloudConfig should only be consumed by the kube_cloud_config controller. The controller is responsible for using the user configuration in the spec for various platforms and combining that with the user provided ConfigMap in this field to create a stitched kube cloud config. The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace with the kube cloud config is stored in `cloud.conf` key. All the clients are expected to use the generated ConfigMap only.", - "platformSpec": "platformSpec holds desired information specific to the underlying infrastructure provider.", - "controlPlaneTopology": "controlPlaneTopology expresses the desired topology configuration for control nodes.\n\nWhen status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable', a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.\n\nWhen left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value, no changes are required and no transitions will be triggered.\n\nThis value may be set to match status.controlPlaneTopology regardless of the current value.", + "": "InfrastructureSpec contains settings that apply to the cluster infrastructure.", + "cloudConfig": "cloudConfig is a reference to a ConfigMap containing the cloud provider configuration file. This configuration file is used to configure the Kubernetes cloud provider integration when using the built-in cloud provider integration or the external cloud controller manager. The namespace for this config map is openshift-config.\n\ncloudConfig should only be consumed by the kube_cloud_config controller. The controller is responsible for using the user configuration in the spec for various platforms and combining that with the user provided ConfigMap in this field to create a stitched kube cloud config. The controller generates a ConfigMap `kube-cloud-config` in `openshift-config-managed` namespace with the kube cloud config is stored in `cloud.conf` key. All the clients are expected to use the generated ConfigMap only.", + "platformSpec": "platformSpec holds desired information specific to the underlying infrastructure provider.", + "controlPlaneTopology": "controlPlaneTopology expresses the desired topology configuration for control nodes.\n\nWhen status.controlPlaneTopology is 'SingleReplica' and spec.controlPlaneTopology is set to 'HighlyAvailable', a transition will be triggered to reconfigure the cluster from SingleReplica to HighlyAvailable.\n\nWhen left blank or status.controlPlaneTopology and spec.controlPlaneTopology are the same value, no changes are required and no transitions will be triggered.\n\nThis value may be set to match status.controlPlaneTopology regardless of the current value.", + "infrastructureTopology": "infrastructureTopology expresses the desired topology for infrastructure services that do not run on control plane nodes, indicating how infrastructure workloads are distributed across nodes.\n\nWhen omitted, no topology transition override has been expressed. Once populated, the field represents the desired topology state.\n\nWhen the value differs from status.infrastructureTopology, the cluster evaluates whether the requested transition can proceed. Not all transitions may be permitted.", } func (InfrastructureSpec) SwaggerDoc() map[string]string { @@ -1882,16 +1883,17 @@ func (InfrastructureSpec) SwaggerDoc() map[string]string { } var map_InfrastructureStatus = map[string]string{ - "": "InfrastructureStatus describes the infrastructure the cluster is leveraging.", - "infrastructureName": "infrastructureName uniquely identifies a cluster with a human friendly name. Once set it should not be changed. Must be of max length 27 and must have only alphanumeric or hyphen characters.", - "platform": "platform is the underlying infrastructure provider for the cluster.\n\nDeprecated: Use platformStatus.type instead.", - "platformStatus": "platformStatus holds status information specific to the underlying infrastructure provider.", - "etcdDiscoveryDomain": "etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering etcd servers and clients. For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.", - "apiServerURL": "apiServerURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerURL can be used by components like the web console to tell users where to find the Kubernetes API.", - "apiServerInternalURI": "apiServerInternalURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components like kubelets, to contact the Kubernetes API server using the infrastructure provider rather than Kubernetes networking.", - "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", - "infrastructureTopology": "infrastructureTopology expresses the expectations for infrastructure services that do not run on control plane nodes, usually indicated by a node selector for a `role` value other than `master`. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation NOTE: External topology mode is not applicable for this field.", - "cpuPartitioning": "cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. Valid values are \"None\" and \"AllNodes\". When omitted, the default value is \"None\". The default value of \"None\" indicates that no nodes will be setup with CPU partitioning. The \"AllNodes\" value indicates that all nodes have been setup with CPU partitioning, and can then be further configured via the PerformanceProfile API.", + "": "InfrastructureStatus describes the infrastructure the cluster is leveraging.", + "infrastructureName": "infrastructureName uniquely identifies a cluster with a human friendly name. Once set it should not be changed. Must be of max length 27 and must have only alphanumeric or hyphen characters.", + "platform": "platform is the underlying infrastructure provider for the cluster.\n\nDeprecated: Use platformStatus.type instead.", + "platformStatus": "platformStatus holds status information specific to the underlying infrastructure provider.", + "etcdDiscoveryDomain": "etcdDiscoveryDomain is the domain used to fetch the SRV records for discovering etcd servers and clients. For more info: https://github.com/etcd-io/etcd/blob/329be66e8b3f9e2e6af83c123ff89297e49ebd15/Documentation/op-guide/clustering.md#dns-discovery deprecated: as of 4.7, this field is no longer set or honored. It will be removed in a future release.", + "apiServerURL": "apiServerURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerURL can be used by components like the web console to tell users where to find the Kubernetes API.", + "apiServerInternalURI": "apiServerInternalURL is a valid URI with scheme 'https', address and optionally a port (defaulting to 443). apiServerInternalURL can be used by components like kubelets, to contact the Kubernetes API server using the infrastructure provider rather than Kubernetes networking.", + "controlPlaneTopology": "controlPlaneTopology expresses the expectations for operands that normally run on control nodes. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation The 'External' mode indicates that the control plane is hosted externally to the cluster and that its components are not visible within the cluster. The 'HighlyAvailableArbiter' mode indicates that the control plane will consist of 2 control-plane nodes that run conventional services and 1 smaller sized arbiter node that runs a bare minimum of services to maintain quorum.", + "infrastructureTopology": "infrastructureTopology expresses the expectations for infrastructure services that do not run on control plane nodes, usually indicated by a node selector for a `role` value other than `master`. The default is 'HighlyAvailable', which represents the behavior operators have in a \"normal\" cluster. The 'SingleReplica' mode will be used in single-node deployments and the operators should not configure the operand for highly-available operation NOTE: External topology mode is not applicable for this field.", + "topologyTransitionStatus": "topologyTransitionStatus reports evaluations of supported topology transitions and the status of a requested transition, if any. It is optional and is omitted until the topology controller reports transition status. A transition is requested through spec.controlPlaneTopology. The controller reports completion only after both topologies reach that transition's target and post-transition checks pass; reaching the target topology alone is not completion.", + "cpuPartitioning": "cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. Valid values are \"None\" and \"AllNodes\". When omitted, the default value is \"None\". The default value of \"None\" indicates that no nodes will be setup with CPU partitioning. The \"AllNodes\" value indicates that all nodes have been setup with CPU partitioning, and can then be further configured via the PerformanceProfile API.", } func (InfrastructureStatus) SwaggerDoc() map[string]string { @@ -2271,6 +2273,36 @@ func (VSpherePlatformVCenterSpec) SwaggerDoc() map[string]string { return map_VSpherePlatformVCenterSpec } +var map_TopologyState = map[string]string{ + "": "TopologyState describes the control-plane and infrastructure topology at one end of a topology transition. The topology controller determines which transitions are supported. Currently, it supports only transitions that change both topologies from SingleReplica to HighlyAvailable. Representing a topology here does not enable a transition to it.", + "controlPlaneTopology": "controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. controlPlaneTopology is required.", + "infrastructureTopology": "infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. infrastructureTopology is required.", +} + +func (TopologyState) SwaggerDoc() map[string]string { + return map_TopologyState +} + +var map_TopologyTransition = map[string]string{ + "source": "source is the control-plane and infrastructure topology this transition was evaluated from. It may differ from the current topology while status is being refreshed. External control planes cannot be a transition source. controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. source is required.", + "target": "target is the control-plane and infrastructure topology this transition would move to. controlPlaneTopology is the topology of the control-plane nodes. Valid values are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. External is not valid: transitions cannot involve an externally hosted control plane. SingleReplica means a single instance of control-plane services is expected to meet cluster needs. HighlyAvailable means multiple instances are expected to provide redundancy. HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter node to maintain quorum. See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. infrastructureTopology is the topology of infrastructure services. Valid values are SingleReplica and HighlyAvailable. SingleReplica means operators expect a single instance of infrastructure services to meet cluster needs. HighlyAvailable means operators expect multiple instances of infrastructure services to provide redundancy. External control planes cannot be a transition target. target is required.", + "evaluations": "evaluations contains the availability condition for this transition and conditions for the checks run against the cluster to determine availability.\n\nTopologyTransitionAvailable is required; other condition types report individual checks. Between one and 32 conditions must be present, allowing at most 31 individual checks in addition to the availability condition. The controller defines individual check types, reasons, and messages, and always reports each one explicitly, using Unknown when a check's result is not yet known.", +} + +func (TopologyTransition) SwaggerDoc() map[string]string { + return map_TopologyTransition +} + +var map_TopologyTransitionStatus = map[string]string{ + "": "TopologyTransitionStatus reports availability of each type of topology transition and contains the status of any initiated transition.", + "conditions": "conditions provides information on topology transition progress and the evaluation of supported transition types. The controller always reports both conditions once topologyTransitionStatus is set.\n\nValid condition types are TopologyTransitionsEvaluated and TopologyTransitionCompleted. Both conditions must be present: the controller always reports each condition explicitly, using Unknown when a condition's state is not yet known, rather than omitting it.", + "transitions": "transitions contains each supported transition type and its availability. It is optional. The controller clears this list whenever TopologyTransitionsEvaluated is not True, so its presence always reflects current, trustworthy results: an omitted list while TopologyTransitionsEvaluated is True means no supported transition options were found, and an omitted list otherwise means no transition options have been reported yet.\n\nBetween one and eight transition options must be present when the list is set. This list reports transition options, not concurrent transitions. The topology controller determines which transition options are supported.", +} + +func (TopologyTransitionStatus) SwaggerDoc() map[string]string { + return map_TopologyTransitionStatus +} + var map_AWSIngressSpec = map[string]string{ "": "AWSIngressSpec holds the desired state of the Ingress for Amazon Web Services infrastructure provider. This only includes fields that can be modified in the cluster.", "type": "type allows user to set a load balancer type. When this field is set the default ingresscontroller will get created using the specified LBType. If this field is not set then the default ingress controller of LBType Classic will be created. Valid values are:\n\n* \"Classic\": A Classic Load Balancer that makes routing decisions at either\n the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS). See\n the following for additional details:\n\n https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#clb\n\n* \"NLB\": A Network Load Balancer that makes routing decisions at the\n transport layer (TCP/SSL). See the following for additional details:\n\n https://docs.aws.amazon.com/AmazonECS/latest/developerguide/load-balancer-types.html#nlb", @@ -2466,15 +2498,25 @@ func (Storage) SwaggerDoc() map[string]string { } var map_KMSPluginConfig = map[string]string{ - "": "KMSPluginConfig defines the configuration for the KMS instance that will be used with KMS encryption", - "type": "type defines the kind of platform for the KMS provider. Allowed values are Vault. When set to Vault, the plugin connects to a HashiCorp Vault server for key management.", - "vault": "vault defines the configuration for the Vault KMS plugin. The plugin connects to a Vault Enterprise server that is managed by the user outside the purview of the control plane. This field must be set when type is Vault, and must be unset otherwise.", + "": "KMSPluginConfig defines the configuration for the KMS instance that will be used with KMS encryption", + "pluginConfig": "pluginConfig is a required reference to a cluster-scoped resource with a status subresource that satisfies the OpenShift KMS plugin configuration status interface.", } func (KMSPluginConfig) SwaggerDoc() map[string]string { return map_KMSPluginConfig } +var map_KMSPluginConfigReference = map[string]string{ + "": "KMSPluginConfigReference identifies a cluster-scoped KMS plugin configuration custom resource.", + "apiVersion": "apiVersion is required and identifies the API version of the referenced KMS plugin configuration resource. The value must be in the format /, where group is a DNS subdomain and version is a Kubernetes API version (for example, v1 or v1alpha1). It must contain between 1 and 64 characters.", + "resource": "resource is required and is the resource name of the referenced KMS plugin configuration custom resource. This is the plural name used in the Kubernetes API (for example, vaultkmsconfigs), not the Kind (for example, VaultKMSConfig). The value must be between 1 and 63 characters, contain only lowercase alphanumeric characters or '-', and start and end with an alphanumeric character.", + "name": "name is required and is the metadata.name of the referenced KMS plugin configuration resource. The referenced resource must be cluster-scoped. The name must be a valid DNS subdomain name: it must contain between 1 and 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character.", +} + +func (KMSPluginConfigReference) SwaggerDoc() map[string]string { + return map_KMSPluginConfigReference +} + var map_VaultAppRoleAuthentication = map[string]string{ "": "VaultAppRoleAuthentication defines the configuration for AppRole authentication with Vault.", "secret": "secret references a secret in the openshift-config namespace containing the AppRole credentials used to authenticate with Vault. The referenced Secret must contain two keys: \"role-id\" for the AppRole Role ID and \"secret-id\" for the AppRole Secret ID.", diff --git a/vendor/github.com/openshift/api/config/v1alpha1/register.go b/vendor/github.com/openshift/api/config/v1alpha1/register.go index 1d84b7107928..a551fb2282c2 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/register.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/register.go @@ -36,10 +36,10 @@ func addKnownTypes(scheme *runtime.Scheme) error { &InsightsDataGatherList{}, &Backup{}, &BackupList{}, - &CRIOCredentialProviderConfig{}, - &CRIOCredentialProviderConfigList{}, &PKI{}, &PKIList{}, + &ControllerManager{}, + &ControllerManagerList{}, ) metav1.AddToGroupVersion(scheme, GroupVersion) return nil diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_controllermanager.go b/vendor/github.com/openshift/api/config/v1alpha1/types_controllermanager.go new file mode 100644 index 000000000000..d85faad066ff --- /dev/null +++ b/vendor/github.com/openshift/api/config/v1alpha1/types_controllermanager.go @@ -0,0 +1,92 @@ +package v1alpha1 + +import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// ControllerManager holds cluster-wide configuration shared by the controller managers +// in the system, among them especially kube-controller-manager. +// The resource is a singleton named "cluster". +// +// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. +// +openshift:compatibility-gen:level=4 +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2668 +// +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01 +// +kubebuilder:object:root=true +// +kubebuilder:resource:path=controllermanagers,scope=Cluster +// +openshift:enable:FeatureGate=ControllerManagerConfig +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="controllermanager is a singleton, .metadata.name must be 'cluster'" +type ControllerManager struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +optional + metav1.ObjectMeta `json:"metadata,omitzero"` + // spec holds user settable values for configuration. + // This field is required but the spec may be empty to express no opinion. + // +required + Spec *ControllerManagerSpec `json:"spec,omitempty,omitzero"` +} + +// ControllerManagerSpec defines the desired state of the controller managers +// +kubebuilder:validation:MinProperties=0 +type ControllerManagerSpec struct { + // volumeForceDetach controls the conditions under which kube-controller-manager + // force detaches volumes from a node that is not healthy. + // Volumes are always force detached when a node is marked out-of-service via the + // "node.kubernetes.io/out-of-service" taint, as part of the non-graceful node + // shutdown procedure. This field controls whether force detach is also triggered + // when the maximum unmount time is exceeded (6 minutes). + // Valid values are "OnUnmountTimeout" and "OnOutOfServiceTaintOnly". + // When set to "OnUnmountTimeout", volumes are force detached from unhealthy nodes + // once the maximum unmount time is exceeded, so that workloads using them can start + // on other nodes. Force detaching a volume that is still in use by the node can + // corrupt its data. + // When set to "OnOutOfServiceTaintOnly", volumes are force detached only via the + // out-of-service taint, and remain attached to an unhealthy node until it recovers + // or the "node.kubernetes.io/out-of-service" taint is applied as part of the + // non-graceful node shutdown procedure. + // When omitted, this means the user has no opinion and the platform is left + // to choose a reasonable default, which is subject to change over time. + // The current default is "OnUnmountTimeout". + // Changing this field causes kube-controller-manager to be redeployed with the new setting. + // Rollout progress is reported by the kube-controller-manager cluster operator. + // +optional + VolumeForceDetach VolumeForceDetachPolicy `json:"volumeForceDetach,omitempty"` +} + +// VolumeForceDetachPolicy describes the conditions under which volumes are +// force detached from an unhealthy node. +// Valid values are "OnUnmountTimeout" and "OnOutOfServiceTaintOnly". +// +enum +// +kubebuilder:validation:Enum=OnUnmountTimeout;OnOutOfServiceTaintOnly +type VolumeForceDetachPolicy string + +const ( + // VolumeForceDetachOnUnmountTimeout force detaches volumes from unhealthy nodes + // once the maximum unmount time is exceeded. + VolumeForceDetachOnUnmountTimeout VolumeForceDetachPolicy = "OnUnmountTimeout" + // VolumeForceDetachOnOutOfServiceTaintOnly force detaches volumes only when + // the node is marked out-of-service, never based on the maximum unmount time. + VolumeForceDetachOnOutOfServiceTaintOnly VolumeForceDetachPolicy = "OnOutOfServiceTaintOnly" +) + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// ControllerManagerList is a collection of ControllerManager resources. +// +// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. +// +openshift:compatibility-gen:level=4 +type ControllerManagerList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + metav1.ListMeta `json:"metadata"` + + // items is a list of ControllerManager resources + Items []ControllerManager `json:"items"` +} diff --git a/vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.go b/vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.go deleted file mode 100644 index 9e2e0d39d28f..000000000000 --- a/vendor/github.com/openshift/api/config/v1alpha1/types_crio_credential_provider_config.go +++ /dev/null @@ -1,186 +0,0 @@ -package v1alpha1 - -import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - -// +genclient -// +genclient:nonNamespaced -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. -// For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. -// CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. -// Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout. -// -// The resource is a singleton named "cluster". -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +kubebuilder:object:root=true -// +kubebuilder:resource:path=criocredentialproviderconfigs,scope=Cluster -// +kubebuilder:subresource:status -// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2557 -// +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01 -// +openshift:enable:FeatureGate=CRIOCredentialProviderConfig -// +openshift:compatibility-gen:level=4 -// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="criocredentialproviderconfig is a singleton, .metadata.name must be 'cluster'" -type CRIOCredentialProviderConfig struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard object's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - // +optional - metav1.ObjectMeta `json:"metadata,omitzero"` - - // spec defines the desired configuration of the CRI-O Credential Provider. - // This field is required and must be provided when creating the resource. - // +required - Spec *CRIOCredentialProviderConfigSpec `json:"spec,omitempty,omitzero"` - - // status represents the current state of the CRIOCredentialProviderConfig. - // When omitted or nil, it indicates that the status has not yet been set by the controller. - // The controller will populate this field with validation conditions and operational state. - // +optional - Status CRIOCredentialProviderConfigStatus `json:"status,omitzero,omitempty"` -} - -// CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider. -// +kubebuilder:validation:MinProperties=0 -type CRIOCredentialProviderConfigSpec struct { - // matchImages is a list of string patterns used to determine whether - // the CRI-O credential provider should be invoked for a given image. This list is - // passed to the kubelet CredentialProviderConfig, and if any pattern matches - // the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling - // that image or its mirrors. - // Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. - // Conflicts between the existing platform specific provider image match configuration and this list will be handled by - // the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those - // from the CRIOCredentialProviderConfig when both match the same image. - // To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with - // existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). - // You can check the resource's Status conditions - // to see if any entries were ignored due to exact matches with known built-in provider patterns. - // - // This field is optional, the items of the list must contain between 1 and 50 entries. - // The list is treated as a set, so duplicate entries are not allowed. - // - // For more details, see: - // https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ - // https://github.com/cri-o/crio-credential-provider#architecture - // - // Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. - // Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', - // and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). - // A global wildcard '*' (matching any domain) is not allowed. - // Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. - // For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. - // Each wildcard matches only a single domain label, - // so '*.io' does **not** match '*.k8s.io'. - // - // A match exists between an image and a matchImage when all of the below are true: - // Both contain the same number of domain parts and each part matches. - // The URL path of an matchImages must be a prefix of the target image URL path. - // If the matchImages contains a port, then the port must match in the image as well. - // - // Example values of matchImages: - // - 123456789.dkr.ecr.us-east-1.amazonaws.com - // - *.azurecr.io - // - gcr.io - // - *.*.registry.io - // - registry.io:8080/path - // - // +kubebuilder:validation:MaxItems=50 - // +kubebuilder:validation:MinItems=1 - // +listType=set - // +optional - MatchImages []MatchImage `json:"matchImages,omitempty"` -} - -// MatchImage is a string pattern used to match container image registry addresses. -// It must be a valid fully qualified domain name with optional wildcard, port, and path. -// The maximum length is 512 characters. -// -// Wildcards ('*') are supported for full subdomain labels and top-level domains. -// Each entry can optionally contain a port (e.g., :8080) and a path (e.g., /path). -// Wildcards are not allowed in the port or path portions. -// -// Examples: -// - "registry.io" - matches exactly registry.io -// - "*.azurecr.io" - matches any single subdomain of azurecr.io -// - "registry.io:8080/path" - matches with specific port and path prefix -// -// +kubebuilder:validation:MaxLength=512 -// +kubebuilder:validation:MinLength=1 -// +kubebuilder:validation:XValidation:rule="self != '*'",message="global wildcard '*' is not allowed" -// +kubebuilder:validation:XValidation:rule=`self.matches('^((\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?)(\\.(\\*|[a-z0-9]([a-z0-9-]*[a-z0-9])?))*)(:[0-9]+)?(/[-a-z0-9._/]*)?$')`,message="invalid matchImages value, must be a valid fully qualified domain name in lowercase with optional wildcard, port, and path" -type MatchImage string - -// +k8s:deepcopy-gen=true -// CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig -// +kubebuilder:validation:MinProperties=1 -type CRIOCredentialProviderConfigStatus struct { - // conditions represent the latest available observations of the configuration state. - // When omitted, it indicates that no conditions have been reported yet. - // The maximum number of conditions is 16. - // Conditions are stored as a map keyed by condition type, ensuring uniqueness. - // - // Expected condition types include: - // "Validated": indicates whether the matchImages configuration is valid - // +optional - // +kubebuilder:validation:MaxItems=16 - // +kubebuilder:validation:MinItems=1 - // +listType=map - // +listMapKey=type - Conditions []metav1.Condition `json:"conditions,omitempty"` -} - -// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object - -// CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources -// -// Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -// +openshift:compatibility-gen:level=4 -type CRIOCredentialProviderConfigList struct { - metav1.TypeMeta `json:",inline"` - - // metadata is the standard list's metadata. - // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - metav1.ListMeta `json:"metadata"` - - Items []CRIOCredentialProviderConfig `json:"items"` -} - -const ( - // ConditionTypeValidated is a condition type that indicates whether the CRIOCredentialProviderConfig - // matchImages configuration has been validated successfully. - // When True, all matchImage patterns are valid and have been applied. - // When False, the configuration contains errors (see Reason for details). - // Possible reasons for False status: - // - ValidationFailed: matchImages contains invalid patterns - // - ConfigurationPartiallyApplied: some matchImage entries were ignored due to conflicts - ConditionTypeValidated = "Validated" - - // ReasonValidationFailed is a condition reason used with ConditionTypeValidated=False - // to indicate that the matchImages configuration contains one or more invalid registry patterns - // that do not conform to the required format (valid FQDN with optional wildcard, port, and path). - ReasonValidationFailed = "ValidationFailed" - - // ReasonConfigurationPartiallyApplied is a condition reason used with ConditionTypeValidated=False - // to indicate that some matchImage entries were ignored due to conflicts or overlapping patterns. - // The condition message will contain details about which entries were ignored and why. - ReasonConfigurationPartiallyApplied = "ConfigurationPartiallyApplied" - - // ConditionTypeMachineConfigRendered is a condition type that indicates whether - // the CRIOCredentialProviderConfig has been successfully rendered into a - // MachineConfig object. - // When True, the corresponding MachineConfig is present in the cluster. - // When False, rendering failed. - ConditionTypeMachineConfigRendered = "MachineConfigRendered" - - // ReasonMachineConfigRenderingSucceeded is a condition reason used with ConditionTypeMachineConfigRendered=True - // to indicate that the MachineConfig was successfully created/updated in the API server. - ReasonMachineConfigRenderingSucceeded = "MachineConfigRenderingSucceeded" - - // ReasonMachineConfigRenderingFailed is a condition reason used with ConditionTypeMachineConfigRendered=False - // to indicate that the MachineConfig creation/update failed. - // The condition message will contain details about the failure. - ReasonMachineConfigRenderingFailed = "MachineConfigRenderingFailed" -) diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go index 598f38fc5de0..ca1b9e5a2071 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go @@ -7,7 +7,6 @@ package v1alpha1 import ( v1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" runtime "k8s.io/apimachinery/pkg/runtime" ) @@ -251,31 +250,44 @@ func (in *BasicAuth) DeepCopy() *BasicAuth { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CRIOCredentialProviderConfig) DeepCopyInto(out *CRIOCredentialProviderConfig) { +func (in *CertificateConfig) DeepCopyInto(out *CertificateConfig) { + *out = *in + out.Key = in.Key + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateConfig. +func (in *CertificateConfig) DeepCopy() *CertificateConfig { + if in == nil { + return nil + } + out := new(CertificateConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClusterMonitoring) DeepCopyInto(out *ClusterMonitoring) { *out = *in out.TypeMeta = in.TypeMeta in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - if in.Spec != nil { - in, out := &in.Spec, &out.Spec - *out = new(CRIOCredentialProviderConfigSpec) - (*in).DeepCopyInto(*out) - } - in.Status.DeepCopyInto(&out.Status) + in.Spec.DeepCopyInto(&out.Spec) + out.Status = in.Status return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CRIOCredentialProviderConfig. -func (in *CRIOCredentialProviderConfig) DeepCopy() *CRIOCredentialProviderConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoring. +func (in *ClusterMonitoring) DeepCopy() *ClusterMonitoring { if in == nil { return nil } - out := new(CRIOCredentialProviderConfig) + out := new(ClusterMonitoring) in.DeepCopyInto(out) return out } // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *CRIOCredentialProviderConfig) DeepCopyObject() runtime.Object { +func (in *ClusterMonitoring) DeepCopyObject() runtime.Object { if c := in.DeepCopy(); c != nil { return c } @@ -283,13 +295,13 @@ func (in *CRIOCredentialProviderConfig) DeepCopyObject() runtime.Object { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CRIOCredentialProviderConfigList) DeepCopyInto(out *CRIOCredentialProviderConfigList) { +func (in *ClusterMonitoringList) DeepCopyInto(out *ClusterMonitoringList) { *out = *in out.TypeMeta = in.TypeMeta in.ListMeta.DeepCopyInto(&out.ListMeta) if in.Items != nil { in, out := &in.Items, &out.Items - *out = make([]CRIOCredentialProviderConfig, len(*in)) + *out = make([]ClusterMonitoring, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } @@ -297,18 +309,18 @@ func (in *CRIOCredentialProviderConfigList) DeepCopyInto(out *CRIOCredentialProv return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CRIOCredentialProviderConfigList. -func (in *CRIOCredentialProviderConfigList) DeepCopy() *CRIOCredentialProviderConfigList { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringList. +func (in *ClusterMonitoringList) DeepCopy() *ClusterMonitoringList { if in == nil { return nil } - out := new(CRIOCredentialProviderConfigList) + out := new(ClusterMonitoringList) in.DeepCopyInto(out) return out } // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *CRIOCredentialProviderConfigList) DeepCopyObject() runtime.Object { +func (in *ClusterMonitoringList) DeepCopyObject() runtime.Object { if c := in.DeepCopy(); c != nil { return c } @@ -316,88 +328,92 @@ func (in *CRIOCredentialProviderConfigList) DeepCopyObject() runtime.Object { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CRIOCredentialProviderConfigSpec) DeepCopyInto(out *CRIOCredentialProviderConfigSpec) { +func (in *ClusterMonitoringSpec) DeepCopyInto(out *ClusterMonitoringSpec) { *out = *in - if in.MatchImages != nil { - in, out := &in.MatchImages, &out.MatchImages - *out = make([]MatchImage, len(*in)) - copy(*out, *in) - } + out.UserDefined = in.UserDefined + in.AlertmanagerConfig.DeepCopyInto(&out.AlertmanagerConfig) + in.PrometheusConfig.DeepCopyInto(&out.PrometheusConfig) + in.MetricsServerConfig.DeepCopyInto(&out.MetricsServerConfig) + in.PrometheusOperatorConfig.DeepCopyInto(&out.PrometheusOperatorConfig) + in.PrometheusOperatorAdmissionWebhookConfig.DeepCopyInto(&out.PrometheusOperatorAdmissionWebhookConfig) + in.OpenShiftStateMetricsConfig.DeepCopyInto(&out.OpenShiftStateMetricsConfig) + in.TelemeterClientConfig.DeepCopyInto(&out.TelemeterClientConfig) + in.ThanosQuerierConfig.DeepCopyInto(&out.ThanosQuerierConfig) + in.NodeExporterConfig.DeepCopyInto(&out.NodeExporterConfig) + in.MonitoringPluginConfig.DeepCopyInto(&out.MonitoringPluginConfig) + in.KubeStateMetricsConfig.DeepCopyInto(&out.KubeStateMetricsConfig) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CRIOCredentialProviderConfigSpec. -func (in *CRIOCredentialProviderConfigSpec) DeepCopy() *CRIOCredentialProviderConfigSpec { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringSpec. +func (in *ClusterMonitoringSpec) DeepCopy() *ClusterMonitoringSpec { if in == nil { return nil } - out := new(CRIOCredentialProviderConfigSpec) + out := new(ClusterMonitoringSpec) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CRIOCredentialProviderConfigStatus) DeepCopyInto(out *CRIOCredentialProviderConfigStatus) { +func (in *ClusterMonitoringStatus) DeepCopyInto(out *ClusterMonitoringStatus) { *out = *in - if in.Conditions != nil { - in, out := &in.Conditions, &out.Conditions - *out = make([]metav1.Condition, len(*in)) - for i := range *in { - (*in)[i].DeepCopyInto(&(*out)[i]) - } - } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CRIOCredentialProviderConfigStatus. -func (in *CRIOCredentialProviderConfigStatus) DeepCopy() *CRIOCredentialProviderConfigStatus { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringStatus. +func (in *ClusterMonitoringStatus) DeepCopy() *ClusterMonitoringStatus { if in == nil { return nil } - out := new(CRIOCredentialProviderConfigStatus) + out := new(ClusterMonitoringStatus) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *CertificateConfig) DeepCopyInto(out *CertificateConfig) { +func (in *ContainerResource) DeepCopyInto(out *ContainerResource) { *out = *in - out.Key = in.Key + out.Request = in.Request.DeepCopy() + out.Limit = in.Limit.DeepCopy() return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateConfig. -func (in *CertificateConfig) DeepCopy() *CertificateConfig { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResource. +func (in *ContainerResource) DeepCopy() *ContainerResource { if in == nil { return nil } - out := new(CertificateConfig) + out := new(ContainerResource) in.DeepCopyInto(out) return out } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterMonitoring) DeepCopyInto(out *ClusterMonitoring) { +func (in *ControllerManager) DeepCopyInto(out *ControllerManager) { *out = *in out.TypeMeta = in.TypeMeta in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) - in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status + if in.Spec != nil { + in, out := &in.Spec, &out.Spec + *out = new(ControllerManagerSpec) + **out = **in + } return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoring. -func (in *ClusterMonitoring) DeepCopy() *ClusterMonitoring { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManager. +func (in *ControllerManager) DeepCopy() *ControllerManager { if in == nil { return nil } - out := new(ClusterMonitoring) + out := new(ControllerManager) in.DeepCopyInto(out) return out } // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ClusterMonitoring) DeepCopyObject() runtime.Object { +func (in *ControllerManager) DeepCopyObject() runtime.Object { if c := in.DeepCopy(); c != nil { return c } @@ -405,13 +421,13 @@ func (in *ClusterMonitoring) DeepCopyObject() runtime.Object { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterMonitoringList) DeepCopyInto(out *ClusterMonitoringList) { +func (in *ControllerManagerList) DeepCopyInto(out *ControllerManagerList) { *out = *in out.TypeMeta = in.TypeMeta in.ListMeta.DeepCopyInto(&out.ListMeta) if in.Items != nil { in, out := &in.Items, &out.Items - *out = make([]ClusterMonitoring, len(*in)) + *out = make([]ControllerManager, len(*in)) for i := range *in { (*in)[i].DeepCopyInto(&(*out)[i]) } @@ -419,18 +435,18 @@ func (in *ClusterMonitoringList) DeepCopyInto(out *ClusterMonitoringList) { return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringList. -func (in *ClusterMonitoringList) DeepCopy() *ClusterMonitoringList { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManagerList. +func (in *ControllerManagerList) DeepCopy() *ControllerManagerList { if in == nil { return nil } - out := new(ClusterMonitoringList) + out := new(ControllerManagerList) in.DeepCopyInto(out) return out } // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. -func (in *ClusterMonitoringList) DeepCopyObject() runtime.Object { +func (in *ControllerManagerList) DeepCopyObject() runtime.Object { if c := in.DeepCopy(); c != nil { return c } @@ -438,63 +454,17 @@ func (in *ClusterMonitoringList) DeepCopyObject() runtime.Object { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterMonitoringSpec) DeepCopyInto(out *ClusterMonitoringSpec) { +func (in *ControllerManagerSpec) DeepCopyInto(out *ControllerManagerSpec) { *out = *in - out.UserDefined = in.UserDefined - in.AlertmanagerConfig.DeepCopyInto(&out.AlertmanagerConfig) - in.PrometheusConfig.DeepCopyInto(&out.PrometheusConfig) - in.MetricsServerConfig.DeepCopyInto(&out.MetricsServerConfig) - in.PrometheusOperatorConfig.DeepCopyInto(&out.PrometheusOperatorConfig) - in.PrometheusOperatorAdmissionWebhookConfig.DeepCopyInto(&out.PrometheusOperatorAdmissionWebhookConfig) - in.OpenShiftStateMetricsConfig.DeepCopyInto(&out.OpenShiftStateMetricsConfig) - in.TelemeterClientConfig.DeepCopyInto(&out.TelemeterClientConfig) - in.ThanosQuerierConfig.DeepCopyInto(&out.ThanosQuerierConfig) - in.NodeExporterConfig.DeepCopyInto(&out.NodeExporterConfig) - in.MonitoringPluginConfig.DeepCopyInto(&out.MonitoringPluginConfig) - in.KubeStateMetricsConfig.DeepCopyInto(&out.KubeStateMetricsConfig) return } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringSpec. -func (in *ClusterMonitoringSpec) DeepCopy() *ClusterMonitoringSpec { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManagerSpec. +func (in *ControllerManagerSpec) DeepCopy() *ControllerManagerSpec { if in == nil { return nil } - out := new(ClusterMonitoringSpec) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ClusterMonitoringStatus) DeepCopyInto(out *ClusterMonitoringStatus) { - *out = *in - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterMonitoringStatus. -func (in *ClusterMonitoringStatus) DeepCopy() *ClusterMonitoringStatus { - if in == nil { - return nil - } - out := new(ClusterMonitoringStatus) - in.DeepCopyInto(out) - return out -} - -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ContainerResource) DeepCopyInto(out *ContainerResource) { - *out = *in - out.Request = in.Request.DeepCopy() - out.Limit = in.Limit.DeepCopy() - return -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ContainerResource. -func (in *ContainerResource) DeepCopy() *ContainerResource { - if in == nil { - return nil - } - out := new(ContainerResource) + out := new(ControllerManagerSpec) in.DeepCopyInto(out) return out } diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml index b2a124193775..689b572d6266 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.featuregated-crd-manifests.yaml @@ -21,51 +21,51 @@ backups.config.openshift.io: - AutomatedEtcdBackup Version: v1alpha1 -criocredentialproviderconfigs.config.openshift.io: - Annotations: {} - ApprovedPRNumber: https://github.com/openshift/api/pull/2557 - CRDName: criocredentialproviderconfigs.config.openshift.io +clustermonitorings.config.openshift.io: + Annotations: + description: Cluster Monitoring Operators configuration API + ApprovedPRNumber: https://github.com/openshift/api/pull/1929 + CRDName: clustermonitorings.config.openshift.io Capability: "" Category: "" FeatureGates: - - CRIOCredentialProviderConfig + - ClusterMonitoringConfig FilenameOperatorName: config-operator FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_10" GroupName: config.openshift.io HasStatus: true - KindName: CRIOCredentialProviderConfig + KindName: ClusterMonitoring Labels: {} - PluralName: criocredentialproviderconfigs + PluralName: clustermonitorings PrinterColumns: [] Scope: Cluster ShortNames: null TopLevelFeatureGates: - - CRIOCredentialProviderConfig + - ClusterMonitoringConfig Version: v1alpha1 -clustermonitorings.config.openshift.io: - Annotations: - description: Cluster Monitoring Operators configuration API - ApprovedPRNumber: https://github.com/openshift/api/pull/1929 - CRDName: clustermonitorings.config.openshift.io +controllermanagers.config.openshift.io: + Annotations: {} + ApprovedPRNumber: https://github.com/openshift/api/pull/2668 + CRDName: controllermanagers.config.openshift.io Capability: "" Category: "" FeatureGates: - - ClusterMonitoringConfig + - ControllerManagerConfig FilenameOperatorName: config-operator FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_10" GroupName: config.openshift.io - HasStatus: true - KindName: ClusterMonitoring + HasStatus: false + KindName: ControllerManager Labels: {} - PluralName: clustermonitorings + PluralName: controllermanagers PrinterColumns: [] Scope: Cluster ShortNames: null TopLevelFeatureGates: - - ClusterMonitoringConfig + - ControllerManagerConfig Version: v1alpha1 insightsdatagathers.config.openshift.io: diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go index 8159016737cd..97d63a451bdc 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go @@ -55,26 +55,6 @@ func (in BasicAuth) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.BasicAuth" } -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in CRIOCredentialProviderConfig) OpenAPIModelName() string { - return "com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfig" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in CRIOCredentialProviderConfigList) OpenAPIModelName() string { - return "com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigList" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in CRIOCredentialProviderConfigSpec) OpenAPIModelName() string { - return "com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec" -} - -// OpenAPIModelName returns the OpenAPI model name for this type. -func (in CRIOCredentialProviderConfigStatus) OpenAPIModelName() string { - return "com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus" -} - // OpenAPIModelName returns the OpenAPI model name for this type. func (in CertificateConfig) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.CertificateConfig" @@ -105,6 +85,21 @@ func (in ContainerResource) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.ContainerResource" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ControllerManager) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.ControllerManager" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ControllerManagerList) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.ControllerManagerList" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ControllerManagerSpec) OpenAPIModelName() string { + return "com.github.openshift.api.config.v1alpha1.ControllerManagerSpec" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in CustomPKIPolicy) OpenAPIModelName() string { return "com.github.openshift.api.config.v1alpha1.CustomPKIPolicy" diff --git a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go index 99d9b5a66f44..9c0ed28d6038 100644 --- a/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go @@ -811,42 +811,33 @@ func (UserDefinedMonitoring) SwaggerDoc() map[string]string { return map_UserDefinedMonitoring } -var map_CRIOCredentialProviderConfig = map[string]string{ - "": "CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is \"cluster\". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout.\n\nThe resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", +var map_ControllerManager = map[string]string{ + "": "ControllerManager holds cluster-wide configuration shared by the controller managers in the system, among them especially kube-controller-manager. The resource is a singleton named \"cluster\".\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", - "spec": "spec defines the desired configuration of the CRI-O Credential Provider. This field is required and must be provided when creating the resource.", - "status": "status represents the current state of the CRIOCredentialProviderConfig. When omitted or nil, it indicates that the status has not yet been set by the controller. The controller will populate this field with validation conditions and operational state.", + "spec": "spec holds user settable values for configuration. This field is required but the spec may be empty to express no opinion.", } -func (CRIOCredentialProviderConfig) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfig +func (ControllerManager) SwaggerDoc() map[string]string { + return map_ControllerManager } -var map_CRIOCredentialProviderConfigList = map[string]string{ - "": "CRIOCredentialProviderConfigList contains a list of CRIOCredentialProviderConfig resources\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", +var map_ControllerManagerList = map[string]string{ + "": "ControllerManagerList is a collection of ControllerManager resources.\n\nCompatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support.", "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of ControllerManager resources", } -func (CRIOCredentialProviderConfigList) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigList +func (ControllerManagerList) SwaggerDoc() map[string]string { + return map_ControllerManagerList } -var map_CRIOCredentialProviderConfigSpec = map[string]string{ - "": "CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider.", - "matchImages": "matchImages is a list of string patterns used to determine whether the CRI-O credential provider should be invoked for a given image. This list is passed to the kubelet CredentialProviderConfig, and if any pattern matches the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling that image or its mirrors. Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. Conflicts between the existing platform specific provider image match configuration and this list will be handled by the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those from the CRIOCredentialProviderConfig when both match the same image. To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). You can check the resource's Status conditions to see if any entries were ignored due to exact matches with known built-in provider patterns.\n\nThis field is optional, the items of the list must contain between 1 and 50 entries. The list is treated as a set, so duplicate entries are not allowed.\n\nFor more details, see: https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ https://github.com/cri-o/crio-credential-provider#architecture\n\nEach entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). A global wildcard '*' (matching any domain) is not allowed. Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. Each wildcard matches only a single domain label, so '*.io' does **not** match '*.k8s.io'.\n\nA match exists between an image and a matchImage when all of the below are true: Both contain the same number of domain parts and each part matches. The URL path of an matchImages must be a prefix of the target image URL path. If the matchImages contains a port, then the port must match in the image as well.\n\nExample values of matchImages: - 123456789.dkr.ecr.us-east-1.amazonaws.com - *.azurecr.io - gcr.io - *.*.registry.io - registry.io:8080/path", +var map_ControllerManagerSpec = map[string]string{ + "": "ControllerManagerSpec defines the desired state of the controller managers", + "volumeForceDetach": "volumeForceDetach controls the conditions under which kube-controller-manager force detaches volumes from a node that is not healthy. Volumes are always force detached when a node is marked out-of-service via the \"node.kubernetes.io/out-of-service\" taint, as part of the non-graceful node shutdown procedure. This field controls whether force detach is also triggered when the maximum unmount time is exceeded (6 minutes). Valid values are \"OnUnmountTimeout\" and \"OnOutOfServiceTaintOnly\". When set to \"OnUnmountTimeout\", volumes are force detached from unhealthy nodes once the maximum unmount time is exceeded, so that workloads using them can start on other nodes. Force detaching a volume that is still in use by the node can corrupt its data. When set to \"OnOutOfServiceTaintOnly\", volumes are force detached only via the out-of-service taint, and remain attached to an unhealthy node until it recovers or the \"node.kubernetes.io/out-of-service\" taint is applied as part of the non-graceful node shutdown procedure. When omitted, this means the user has no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is \"OnUnmountTimeout\". Changing this field causes kube-controller-manager to be redeployed with the new setting. Rollout progress is reported by the kube-controller-manager cluster operator.", } -func (CRIOCredentialProviderConfigSpec) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigSpec -} - -var map_CRIOCredentialProviderConfigStatus = map[string]string{ - "": "CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig", - "conditions": "conditions represent the latest available observations of the configuration state. When omitted, it indicates that no conditions have been reported yet. The maximum number of conditions is 16. Conditions are stored as a map keyed by condition type, ensuring uniqueness.\n\nExpected condition types include: \"Validated\": indicates whether the matchImages configuration is valid", -} - -func (CRIOCredentialProviderConfigStatus) SwaggerDoc() map[string]string { - return map_CRIOCredentialProviderConfigStatus +func (ControllerManagerSpec) SwaggerDoc() map[string]string { + return map_ControllerManagerSpec } var map_GatherConfig = map[string]string{ diff --git a/vendor/github.com/openshift/api/envtest-releases.yaml b/vendor/github.com/openshift/api/envtest-releases.yaml index 4705c327e0be..a3a6d729e31a 100644 --- a/vendor/github.com/openshift/api/envtest-releases.yaml +++ b/vendor/github.com/openshift/api/envtest-releases.yaml @@ -129,3 +129,16 @@ releases: envtest-v1.36.2-linux-arm64.tar.gz: hash: bbe6810d76c91349cdee6daf65a6a9289010d48ddc2c42d9e163897a927b6ff7de9d0addc75bd54721cfa5048f8aafcac06a950efa59f4a686f037d1386811de selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.36.2-linux-arm64.tar.gz + v1.37.1: + envtest-v1.37.1-darwin-amd64.tar.gz: + hash: 97c48c7e57a174b0b2103de2259f264b440b9b2268ca04e9ab41dd0d288a491135eeba95b577bb424deabee6ed21bf8d1bbbd2dd9fa742d38fd77ad90060f0c9 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.37.1-darwin-amd64.tar.gz + envtest-v1.37.1-darwin-arm64.tar.gz: + hash: 4708ec31158d6d91ed8d53b1285f6fb7ee160f331f1922caa3c6936346684a0f1bc19256a114f39d9ab344500ff3821e9283edeb9f24b3246523708c7476b39a + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.37.1-darwin-arm64.tar.gz + envtest-v1.37.1-linux-amd64.tar.gz: + hash: 5b1bcc7cc8a8f09f1032a41c1455b128d01222d5b87a8c298b3ba3204f625bf2b0d9eaa7603eff2574bc03c53931ef362d961e6f1f7fe6cdc0a3978451ada458 + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.37.1-linux-amd64.tar.gz + envtest-v1.37.1-linux-arm64.tar.gz: + hash: c1131e89f99171893a8849e6d657cbe2429f1f5a8adce2d7499edfc673963f12cc70f8113f0863d13db30beb0455bc60989c9d49494e10a85010a73d09aec64c + selfLink: https://storage.googleapis.com/openshift-kubebuilder-tools/envtest-v1.37.1-linux-arm64.tar.gz diff --git a/vendor/github.com/openshift/api/features.md b/vendor/github.com/openshift/api/features.md index c281bf4459bc..9183c7e2f1c3 100644 --- a/vendor/github.com/openshift/api/features.md +++ b/vendor/github.com/openshift/api/features.md @@ -2,7 +2,7 @@ | ------ | --- | --- | --- | --- | --- | --- | --- | --- | | ClientsAllowCBOR| | | | | | | | | | ClusterAPIInstall| | | | | | | | | -| DRADeviceTaintRules| | | | | | | | | +| CompositePodGroup| | | | | | | | | | EventedPLEG| | | | | | | | | | MachineAPIMigrationAzure| | | | | | | | | | MachineAPIMigrationBareMetal| | | | | | | | | @@ -11,16 +11,20 @@ | MachineAPIOperatorDisableMachineHealthCheckController| | | | | | | | | | MultiArchInstallAzure| | | | | | | | | | ShortCertRotation| | | | | | | | | +| ControllerManagerConfig| | | | Enabled | | | | | | KarpenterOperator| | | | Enabled | | | | | | MutableTopology| | | | Enabled | | | | | -| AuthenticationComponentProxy| | | | Enabled | | | | Enabled | +| UnifiedClusterManagedDNSAndLB| | | | Enabled | | | | | +| AuthenticationComponentProxyExternalOIDC| | | Enabled | Enabled | | | | | | BGPBasedVIPManagement| | | Enabled | Enabled | | | | | | ClusterAPIComputeInstall| | | Enabled | Enabled | | | | | | ClusterAPIControlPlaneInstall| | | Enabled | Enabled | | | | | +| ClusterAPIOperator| | | | Enabled | | | | Enabled | | ClusterUpdatePreflight| | | Enabled | Enabled | | | | | | ConfidentialCluster| | | Enabled | Enabled | | | | | | Example2| | | Enabled | Enabled | | | | | | MachineAPIMigrationVSphere| | | Enabled | Enabled | | | | | +| MetalEnrollmentAPI| | | Enabled | Enabled | | | | | | NetworkConnect| | | Enabled | Enabled | | | | | | NewOLMBoxCutterRuntime| | | | Enabled | | | | Enabled | | NewOLMCatalogdAPIV1Metas| | | | Enabled | | | | Enabled | @@ -32,6 +36,7 @@ | AWSClusterHostedDNS| | | Enabled | Enabled | | | Enabled | Enabled | | AWSDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | | AWSEuropeanSovereignCloudInstall| | | Enabled | Enabled | | | Enabled | Enabled | +| AuthenticationComponentProxy| | Enabled | | Enabled | | Enabled | | Enabled | | AutomatedEtcdBackup| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled | | AzureDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | @@ -55,23 +60,28 @@ | ClusterVersionOperatorConfiguration| | | Enabled | Enabled | | | Enabled | Enabled | | ConfigurablePKI| | | Enabled | Enabled | | | Enabled | Enabled | | DNSNameResolver| | | Enabled | Enabled | | | Enabled | Enabled | +| DRADeviceTaintRules| | | Enabled | Enabled | | | Enabled | Enabled | +| DRAWorkloadResourceClaims| | | Enabled | Enabled | | | Enabled | Enabled | | DyanmicServiceEndpointIBMCloud| | | Enabled | Enabled | | | Enabled | Enabled | | EgressIPNodeSelector| | | Enabled | Enabled | | | Enabled | Enabled | | Example| | | Enabled | Enabled | | | Enabled | Enabled | +| ExternalOIDCAsWebhook| | | Enabled | Enabled | | | Enabled | Enabled | | ExternalOIDCExternalClaimsSourcing| | | Enabled | Enabled | | | Enabled | Enabled | | ExternalSnapshotMetadata| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpoints| | | Enabled | Enabled | | | Enabled | Enabled | | GCPCustomAPIEndpointsInstall| | | Enabled | Enabled | | | Enabled | Enabled | | GCPDualStackInstall| | | Enabled | Enabled | | | Enabled | Enabled | | GatewayAPIManagementMode| | | Enabled | Enabled | | | Enabled | Enabled | +| GenericWorkload| | | Enabled | Enabled | | | Enabled | Enabled | | GomaxprocsInjection| | | Enabled | Enabled | | | Enabled | Enabled | | HyperShiftOnlyDynamicResourceAllocation| Enabled | | Enabled | | Enabled | | Enabled | | | ImageModeStatusReporting| | | Enabled | Enabled | | | Enabled | Enabled | | IngressComponentRouteLabels| | | Enabled | Enabled | | | Enabled | Enabled | | IngressControllerLBSecurityGroupsAWS| | | Enabled | Enabled | | | Enabled | Enabled | -| KMSEncryption| | | Enabled | Enabled | | | Enabled | Enabled | +| MACSecurity| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigration| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigrationAWS| | | Enabled | Enabled | | | Enabled | Enabled | +| MachineAPIMigrationNutanix| | | Enabled | Enabled | | | Enabled | Enabled | | MachineAPIMigrationOpenStack| | | Enabled | Enabled | | | Enabled | Enabled | | ManagedBootImagesAWSCAPI| | | Enabled | Enabled | | | Enabled | Enabled | | MaxUnavailableStatefulSet| | | Enabled | Enabled | | | Enabled | Enabled | @@ -87,13 +97,16 @@ | OLMLifecycleAndCompatibility| | Enabled | | Enabled | | Enabled | | Enabled | | OVNObservability| | | Enabled | Enabled | | | Enabled | Enabled | | OnPremDNSRecords| | | Enabled | Enabled | | | Enabled | Enabled | +| OpenShiftPodSecurityAdmission| | | Enabled | Enabled | | | Enabled | Enabled | +| PodGroupPreemptionPolicy| | | Enabled | Enabled | | | Enabled | Enabled | | SignatureStores| | | Enabled | Enabled | | | Enabled | Enabled | +| StoragePathAlert| | | Enabled | Enabled | | | Enabled | Enabled | | TLSGroupPreferences| | | Enabled | Enabled | | | Enabled | Enabled | +| TopologyAwareWorkloadScheduling| | | Enabled | Enabled | | | Enabled | Enabled | | VSphereConfigurableMaxAllowedBlockVolumesPerNode| | | Enabled | Enabled | | | Enabled | Enabled | | AWSClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AWSDualStackInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | AdditionalStorageConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| BootImageSkewEnforcement| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | BuildCSIVolumes| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | DualReplica| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | EVPN| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | @@ -110,13 +123,13 @@ | InsightsConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | InsightsOnDemandDataGather| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | IrreconcilableMachineConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | +| KMSEncryption| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | KMSv1| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ManagedBootImagesCPMS| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MetricsCollectionProfiles| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MutableCSINodeAllocatableCount| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | MutatingAdmissionPolicy| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | OSStreams| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| OpenShiftPodSecurityAdmission| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SELinuxMount| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SELinuxMountGAReadiness| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | ServiceAccountTokenNodeBinding| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/vendor/github.com/openshift/api/install.go b/vendor/github.com/openshift/api/install.go index 6efcc1c29868..16b03da72045 100644 --- a/vendor/github.com/openshift/api/install.go +++ b/vendor/github.com/openshift/api/install.go @@ -47,6 +47,7 @@ import ( "github.com/openshift/api/apiextensions" "github.com/openshift/api/apiserver" "github.com/openshift/api/apps" + "github.com/openshift/api/authentication" "github.com/openshift/api/authorization" "github.com/openshift/api/build" "github.com/openshift/api/cloudnetwork" @@ -85,6 +86,7 @@ var ( apiextensions.Install, apiserver.Install, apps.Install, + authentication.Install, authorization.Install, build.Install, config.Install, diff --git a/vendor/github.com/openshift/api/operator/v1/register.go b/vendor/github.com/openshift/api/operator/v1/register.go index 5920c4fca71d..7825af99f621 100644 --- a/vendor/github.com/openshift/api/operator/v1/register.go +++ b/vendor/github.com/openshift/api/operator/v1/register.go @@ -70,6 +70,8 @@ func addKnownTypes(scheme *runtime.Scheme) error { &ServiceCatalogAPIServerList{}, &ServiceCatalogControllerManager{}, &ServiceCatalogControllerManagerList{}, + &Ingress{}, + &IngressList{}, &IngressController{}, &IngressControllerList{}, &InsightsOperator{}, diff --git a/vendor/github.com/openshift/api/operator/v1/types_console.go b/vendor/github.com/openshift/api/operator/v1/types_console.go index 35795b2b71b8..0e5d00382edf 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_console.go +++ b/vendor/github.com/openshift/api/operator/v1/types_console.go @@ -35,6 +35,19 @@ type Console struct { // ConsoleSpec is the specification of the desired behavior of the Console. type ConsoleSpec struct { OperatorSpec `json:",inline"` + + // authProxy configures proxy settings for outbound connections made by + // Console's OIDC login clients, including discovery, JWKS retrieval, + // code exchange, and token refresh. When set, it replaces the cluster-wide + // proxy (proxy.config.openshift.io/cluster) entirely for these connections; + // individual fields are not inherited from the cluster-wide configuration. + // At least one of httpProxy or httpsProxy must be specified. + // When omitted, the cluster-wide proxy is used if configured; otherwise no + // proxy is used. Other Console clients retain their existing proxy settings. + // +openshift:enable:FeatureGate=AuthenticationComponentProxyExternalOIDC + // +optional + AuthProxy ConsoleAuthProxyConfig `json:"authProxy,omitzero"` + // customization is used to optionally provide a small set of // customization options to the web console. // +optional @@ -54,13 +67,90 @@ type ConsoleSpec struct { // +optional Route ConsoleConfigRoute `json:"route"` // plugins defines a list of enabled console plugin names. + // +listType=atomic // +optional Plugins []string `json:"plugins,omitempty"` // ingress allows to configure the alternative ingress for the console. // This field is intended for clusters without ingress capability, // where access to routes is not possible. // +optional - Ingress Ingress `json:"ingress"` + Ingress ConsoleIngress `json:"ingress"` +} + +// ConsoleAuthProxyConfig holds proxy configuration scoped to Console's OIDC login clients. +// At least one of httpProxy or httpsProxy must be specified. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="has(self.httpProxy) || has(self.httpsProxy)",message="at least one of httpProxy or httpsProxy must be specified" +type ConsoleAuthProxyConfig struct { + // httpProxy is the URL of the proxy for HTTP requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="httpProxy must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() in ['http', 'https']",message="httpProxy must use http or https scheme" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || size(url(self).getHostname()) > 0",message="httpProxy must contain a hostname" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/'",message="httpProxy must not contain a path" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getQuery().size() == 0",message="httpProxy must not contain query parameters" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*#.*')",message="httpProxy must not contain a fragment" + // +optional + HTTPProxy string `json:"httpProxy,omitempty"` + + // httpsProxy is the URL of the proxy for HTTPS requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=2048 + // +kubebuilder:validation:XValidation:rule="isURL(self)",message="httpsProxy must be a valid URL" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getScheme() in ['http', 'https']",message="httpsProxy must use http or https scheme" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || size(url(self).getHostname()) > 0",message="httpsProxy must contain a hostname" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getEscapedPath() == '' || url(self).getEscapedPath() == '/'",message="httpsProxy must not contain a path" + // +kubebuilder:validation:XValidation:rule="!isURL(self) || url(self).getQuery().size() == 0",message="httpsProxy must not contain query parameters" + // +kubebuilder:validation:XValidation:rule="!self.matches('.*#.*')",message="httpsProxy must not contain a fragment" + // +optional + HTTPSProxy string `json:"httpsProxy,omitempty"` + + // noProxy is a list of hostnames and/or CIDRs and/or IPs for which + // the proxy should not be used. Must contain at least one entry + // when set. Each entry must be between 1 and 253 characters long + // and at most 64 entries are allowed. Duplicate + // entries are not permitted. Entries that are not valid hostnames, + // CIDRs, or IPs are silently ignored. Cluster-internal defaults + // (.cluster.local, .svc, 127.0.0.1, localhost) are always appended + // automatically and do not need to be included. + // +listType=set + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=64 + // +kubebuilder:validation:items:MinLength=1 + // +kubebuilder:validation:items:MaxLength=253 + // +optional + NoProxy []string `json:"noProxy,omitempty"` + + // trustedCA is a reference to a ConfigMap in the openshift-config + // namespace containing a CA certificate bundle under the key + // "ca-bundle.crt". This bundle is appended to the system trust store + // used by Console's OIDC login clients for proxy TLS connections. + // When omitted, only the system trust store is used. + // +optional + TrustedCA ConsoleAuthProxyTrustedCAConfigMapReference `json:"trustedCA,omitzero"` +} + +// ConsoleAuthProxyTrustedCAConfigMapReference references a ConfigMap in the +// openshift-config namespace. +type ConsoleAuthProxyTrustedCAConfigMapReference struct { + // name is the metadata.name of the referenced ConfigMap. + // Must be a valid DNS subdomain name (RFC 1123): at most 253 + // characters, only lowercase alphanumeric characters, '-' or + // '.', starting and ending with an alphanumeric character. + // +kubebuilder:validation:MinLength=1 + // +kubebuilder:validation:MaxLength=253 + // +kubebuilder:validation:XValidation:rule="!format.dns1123Subdomain().validate(self).hasValue()",message="name must be a valid DNS subdomain name: contain no more than 253 characters, contain only lowercase alphanumeric characters, '-' or '.', and start and end with an alphanumeric character" + // +required + Name string `json:"name,omitempty"` } // ConsoleConfigRoute holds information on external route access to console. @@ -344,6 +434,7 @@ type ConsoleCustomization struct { type ProjectAccess struct { // availableClusterRoles is the list of ClusterRole names that are assignable to users // through the project access tab. + // +listType=atomic // +optional AvailableClusterRoles []string `json:"availableClusterRoles,omitempty"` } @@ -390,6 +481,7 @@ type DeveloperConsoleCatalogTypes struct { // DeveloperConsoleCatalogCustomization allow cluster admin to configure developer catalog. type DeveloperConsoleCatalogCustomization struct { // categories which are shown in the developer catalog. + // +listType=atomic // +optional Categories []DeveloperConsoleCatalogCategory `json:"categories,omitempty"` // types allows enabling or disabling of sub-catalog types that user can see in the Developer catalog. @@ -414,6 +506,7 @@ type DeveloperConsoleCatalogCategoryMeta struct { Label string `json:"label"` // tags is a list of strings that will match the category. A selected category // show all items which has at least one overlapping tag between category and item. + // +listType=atomic // +optional Tags []string `json:"tags,omitempty"` } @@ -423,6 +516,7 @@ type DeveloperConsoleCatalogCategory struct { // defines top level category ID, label and filter tags. DeveloperConsoleCatalogCategoryMeta `json:",inline"` // subcategories defines a list of child categories. + // +listType=atomic // +optional Subcategories []DeveloperConsoleCatalogCategoryMeta `json:"subcategories,omitempty"` } @@ -430,6 +524,7 @@ type DeveloperConsoleCatalogCategory struct { // QuickStarts allow cluster admins to customize available ConsoleQuickStart resources. type QuickStarts struct { // disabled is a list of ConsoleQuickStart resource names that are not shown to users. + // +listType=atomic // +optional Disabled []string `json:"disabled,omitempty"` } @@ -439,6 +534,7 @@ type AddPage struct { // disabledActions is a list of actions that are not shown to users. // Each action in the list is represented by its ID. // +kubebuilder:validation:MinItems=1 + // +listType=atomic // +optional DisabledActions []string `json:"disabledActions,omitempty"` } @@ -460,9 +556,11 @@ const ( // +kubebuilder:validation:MinProperties:=1 type ResourceAttributesAccessReview struct { // required defines a list of permission checks. The perspective will only be shown when all checks are successful. When omitted, the access review is skipped and the perspective will not be shown unless it is required to do so based on the configuration of the missing access review list. + // +listType=atomic // +optional Required []authorizationv1.ResourceAttributes `json:"required"` // missing defines a list of permission checks. The perspective will only be shown when at least one check fails. When omitted, the access review is skipped and the perspective will not be shown unless it is required to do so based on the configuration of the required access review list. + // +listType=atomic // +optional Missing []authorizationv1.ResourceAttributes `json:"missing"` } @@ -498,6 +596,7 @@ type Perspective struct { // The console will also provide a configuration UI and a YAML snippet that will list the available resources that can be pinned to the navigation. // Incorrect or unknown resources will be ignored. // +kubebuilder:validation:MaxItems=100 + // +listType=atomic // +optional PinnedResources *[]PinnedResourceReference `json:"pinnedResources,omitempty"` } @@ -559,7 +658,7 @@ const ( ) // Ingress allows cluster admin to configure alternative ingress for the console. -type Ingress struct { +type ConsoleIngress struct { // consoleURL is a URL to be used as the base console address. // If not specified, the console route hostname will be used. // This field is required for clusters without ingress capability, diff --git a/vendor/github.com/openshift/api/operator/v1/types_ingress.go b/vendor/github.com/openshift/api/operator/v1/types_ingress.go new file mode 100644 index 000000000000..a031b4e57e46 --- /dev/null +++ b/vendor/github.com/openshift/api/operator/v1/types_ingress.go @@ -0,0 +1,146 @@ +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// +genclient +// +genclient:nonNamespaced +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// Ingress contains configuration options specific to the Ingress Operator itself, +// including how it manages Gateway API integration. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +// +openshift:file-pattern=cvoRunLevel=0000_50,operatorName=ingress,operatorOrdering=02 +// +kubebuilder:object:root=true +// +kubebuilder:resource:path=ingresses,scope=Cluster +// +kubebuilder:subresource:status +// +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2890 +// +openshift:capability=Ingress +// +openshift:enable:FeatureGate=GatewayAPIManagementMode +// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="Ingress is a singleton; the .metadata.name field must be 'cluster'" +type Ingress struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + // +required + metav1.ObjectMeta `json:"metadata"` + + // spec holds user settable values for configuration. + // +required + Spec IngressSpec `json:"spec,omitzero"` + + // status holds observed values from the cluster. + // +optional + Status IngressStatus `json:"status,omitzero"` +} + +// IngressSpec is the specification of the desired behavior of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type IngressSpec struct { + // gatewayAPI holds configuration for Gateway API integration, including how the + // ingress operator manages Gateway API CRDs, the OpenShift Gateway API + // implementation, and its Gateway API controllers. + // + // +optional + GatewayAPI GatewayAPIIngressConfig `json:"gatewayAPI,omitzero"` +} + +// IngressStatus defines the observed status of the Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +// +kubebuilder:validation:XValidation:rule="!has(oldSelf.observedGeneration) || (has(self.observedGeneration) && self.observedGeneration >= oldSelf.observedGeneration)",message="observedGeneration must remain set and only increase once set" +type IngressStatus struct { + // conditions is a list of conditions and their status. + // + // Gateway API CRD management conditions are reported here with the "GatewayAPI" prefix: + // + // * "GatewayAPICRDsManaged" indicates whether the ingress operator is actively + // managing Gateway API CRDs. + // * "GatewayAPICRDsPresent" indicates whether Gateway API CRDs exist on the + // cluster. + // * "GatewayAPICRDsCompliant" indicates whether the installed CRDs match the + // version expected by this ingress operator release. + // + // +listType=map + // +listMapKey=type + // +kubebuilder:validation:MinItems=1 + // +kubebuilder:validation:MaxItems=32 + // +optional + Conditions []metav1.Condition `json:"conditions,omitempty"` + + // observedGeneration represents the most recent generation observed by the operator and specifies the version of + // the spec field currently being synced. + // + // When omitted, the operator has not yet observed the resource. + // +optional + // +kubebuilder:validation:Minimum=1 + ObservedGeneration int64 `json:"observedGeneration,omitempty"` +} + +// GatewayAPIIngressConfig holds configuration for Gateway API integration in the +// Cluster Ingress Operator. +// +kubebuilder:validation:MinProperties=1 +type GatewayAPIIngressConfig struct { + // managementMode specifies how the Cluster Ingress Operator manages Gateway API + // Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, + // and its Gateway API controllers. + // + // Allowed values are "Managed" and "Unmanaged". + // + // When omitted or set to "Managed", the ingress operator installs, owns, and + // upgrades the Gateway API CRDs, protects them with a Validating Admission + // Policy, and deploys the OpenShift Gateway API implementation and its Gateway + // API controllers. + // + // When set to "Unmanaged", the ingress operator does not install or manage + // Gateway API CRDs and does not deploy the OpenShift Gateway API implementation + // or its Gateway API controllers. The cluster administrator or a third-party + // product is responsible for providing their own CRDs and Gateway controller. + // The ingress operator reports observational status only. + // + // +optional + ManagementMode GatewayAPIManagementMode `json:"managementMode,omitempty"` +} + +// GatewayAPIManagementMode describes how the Cluster Ingress Operator manages +// Gateway API Custom Resource Definitions. +// +kubebuilder:validation:Enum=Managed;Unmanaged +type GatewayAPIManagementMode string + +const ( + // GatewayAPIManagementModeManaged means the ingress operator installs, owns, + // protects (via a Validating Admission Policy), and upgrades the Gateway API + // CRDs, deploys the OpenShift Gateway API implementation, and runs its Gateway + // API controllers. This is the default mode and the only fully supported + // configuration. + GatewayAPIManagementModeManaged GatewayAPIManagementMode = "Managed" + + // GatewayAPIManagementModeUnmanaged means the ingress operator does not + // install or manage Gateway API CRDs, does not deploy the OpenShift Gateway + // API implementation, and does not run its Gateway API controllers. The + // cluster administrator or a third-party product is responsible for bringing + // their own CRDs and Gateway controller. The ingress operator reports + // observational status only. + GatewayAPIManagementModeUnmanaged GatewayAPIManagementMode = "Unmanaged" +) + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +// IngressList is a collection of Ingresses. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). +// +openshift:compatibility-gen:level=1 +type IngressList struct { + metav1.TypeMeta `json:",inline"` + + // metadata is the standard list's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + metav1.ListMeta `json:"metadata"` + + // items is a list of Ingresses. + // +optional + Items []Ingress `json:"items,omitempty"` +} diff --git a/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go b/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go index 3f6198bd8f19..151c88f7f81e 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go +++ b/vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go @@ -389,19 +389,23 @@ type IngressControllerSpec struct { // haproxyVersion specifies the HAProxy version to use for this // IngressController. // - // OpenShift 5.0 introduces HAProxy 3.2 as its default version and supports - // HAProxy 2.8 from OpenShift 4.22 for migration purposes. When an OpenShift - // release introduces a new default HAProxy version, that HAProxy version - // becomes available as a pinnable value in subsequent OpenShift releases, - // providing a smooth migration path for administrators who want to defer - // HAProxy upgrades. - // - // Valid values for OpenShift 5.0: - // - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.0) - // - "3.2": Explicitly pins HAProxy 3.2 for preservation during cluster - // upgrades to future OpenShift releases - // - "2.8": Uses HAProxy 2.8 from OpenShift 4.22 (migration support, will - // be dropped in the next OpenShift release) + // OpenShift 5.1 uses HAProxy 3.2 as its default version and supports + // HAProxy 3.4 as an explicit, non-default opt-in. + // + // Valid values for OpenShift 5.1: + // - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.1) + // - "3.2": Uses the latest HAProxy 3.2.z available for this OpenShift + // release and pins the minor version. + // - "3.4": Uses the latest HAProxy 3.4.z available for this OpenShift + // release. This is an explicit opt-in; HAProxy 3.4 is not the default. + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default when this field is + // unset, while continuing to support "3.2" as an explicit selection. + // - OpenShift 5.3 plans to retire support for selecting HAProxy 3.2. + // + // Note: HAProxy 2.8 support has been dropped in OpenShift 5.1. Upgrading + // from OpenShift 5.0 with haproxyVersion set to "2.8" is blocked. // // If a specific HAProxy version is set and would become unsupported in a // target cluster upgrade, a preflight check will block the cluster upgrade @@ -2331,9 +2335,14 @@ type IngressControllerStatus struct { // spec.haproxyVersion field. When omitted, the effective value has not yet // been resolved by the operator or the feature is not enabled for this cluster. // - // Examples for OpenShift 5.0: - // - "3.2": Using HAProxy 3.2 - // - "2.8": Using HAProxy 2.8 + // Examples for OpenShift 5.1: + // - "3.2": Using the default HAProxy 3.2 + // - "3.4": Using the explicitly selected, non-default HAProxy 3.4 + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default while keeping + // HAProxy 3.2 selectable. + // - OpenShift 5.3 plans to retire HAProxy 3.2. // // +optional // +openshift:enable:FeatureGate=IngressControllerMultipleHAProxyVersions @@ -2411,13 +2420,13 @@ const ( // format. The allowed values are constrained by enum validation and vary by // OpenShift release. // -// +kubebuilder:validation:Enum="2.8";"3.2" +// +kubebuilder:validation:Enum="3.2";"3.4" type HAProxyVersion string const ( - // HAProxyVersion28 represents HAProxy 2.8, shipped with OpenShift 4.22. - HAProxyVersion28 HAProxyVersion = "2.8" - // HAProxyVersion32 represents HAProxy 3.2, introduced in OpenShift 5.0. HAProxyVersion32 HAProxyVersion = "3.2" + + // HAProxyVersion34 represents HAProxy 3.4, available as a non-default option in OpenShift 5.1. + HAProxyVersion34 HAProxyVersion = "3.4" ) diff --git a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go index 51a981b71655..637a7888dbc7 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go +++ b/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go @@ -142,6 +142,7 @@ const ( // KMSPreflightResult contains the outcome of a preflight validation. // // +openshift:compatibility-gen:level=1 +// +kubebuilder:validation:XValidation:rule="self.status != 'Succeeded' || has(self.remoteKeyID)",message="remoteKeyID is required when status is Succeeded" type KMSPreflightResult struct { // status indicates the outcome of the preflight check. // Succeeded means the KMS plugin responded to Status, Encrypt, and @@ -163,9 +164,12 @@ type KMSPreflightResult struct { // remoteKeyID is the remote key encryption key identifier from KMS v2 // StatusResponse.key_id. This is not a cryptographic key, but a unique // representation of the remote key used to encrypt data. - // The value must be between 1 and 1024 characters. + // When omitted, no remote key identifier is available. This is expected + // when status is Failed, for example when the KMS provider could not be + // reached. When status is Succeeded, remoteKeyID is required. + // When set, the value must be between 1 and 1024 characters. // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:MaxLength=1024 - // +required + // +optional RemoteKeyID string `json:"remoteKeyID,omitempty"` } diff --git a/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go b/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go index 331c82f44dd4..e016d654e85f 100644 --- a/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go +++ b/vendor/github.com/openshift/api/operator/v1/types_machineconfiguration.go @@ -17,10 +17,14 @@ import ( // // Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). // +openshift:compatibility-gen:level=1 -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" -// +openshift:validation:FeatureGateAwareXValidation:featureGate=BootImageSkewEnforcement,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? self.?spec.managedBootImages.hasValue() || self.?status.managedBootImagesStatus.hasValue() : true",message="when skew enforcement is in Automatic mode, a boot image configuration is required" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || size(self.spec.managedBootImages.machineManagers) > 0 : true",message="when skew enforcement is in Automatic mode, managedBootImages.machineManagers must not be an empty list" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any MachineAPI MachineSet MachineManager must use selection mode 'All'" +// +kubebuilder:validation:XValidation:rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'machine.openshift.io'): true",message="when skew enforcement is in Automatic mode, managedBootImagesStatus must contain a MachineManager opting in all MachineAPI MachineSets" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any CAPI MachineSet MachineManager must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || !self.status.managedBootImagesStatus.machineManagers.exists(m, m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io') || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinesets' && m.apiGroup == 'cluster.x-k8s.io'): true",message="when skew enforcement is in Automatic mode, any CAPI MachineSet MachineManager in managedBootImagesStatus must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?spec.managedBootImages.machineManagers.hasValue()) || !self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinedeployments' && m.apiGroup == 'cluster.x-k8s.io') || self.spec.managedBootImages.machineManagers.exists(m, m.resource == 'machinedeployments' && m.selection.mode == 'All') : true",message="when skew enforcement is in Automatic mode, any CAPI MachineDeployment MachineManager must use selection mode 'All'" +// +openshift:validation:FeatureGateAwareXValidation:featureGate=ManagedBootImagesAWSCAPI,rule="self.?status.bootImageSkewEnforcementStatus.mode.orValue(\"\") == 'Automatic' ? !(self.?status.managedBootImagesStatus.machineManagers.hasValue()) || !self.status.managedBootImagesStatus.machineManagers.exists(m, m.resource == 'machinedeployments') || self.status.managedBootImagesStatus.machineManagers.exists(m, m.selection.mode == 'All' && m.resource == 'machinedeployments'): true",message="when skew enforcement is in Automatic mode, any CAPI MachineDeployment MachineManager in managedBootImagesStatus must use selection mode 'All'" type MachineConfiguration struct { metav1.TypeMeta `json:",inline"` @@ -74,7 +78,6 @@ type MachineConfigurationSpec struct { // a skew enforcement mode has been specified. // When version skew is being enforced, cluster upgrades will be disabled until the version skew is deemed // acceptable for the current release payload. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcement BootImageSkewEnforcementConfig `json:"bootImageSkewEnforcement,omitempty,omitzero"` } @@ -296,7 +299,6 @@ type MachineConfigurationStatus struct { // boot image skew should be enforced, cluster upgrades will be blocked until it can either automatically // determine skew enforcement or there is an explicit skew enforcement configuration provided in the // spec.bootImageSkewEnforcement field. - // +openshift:enable:FeatureGate=BootImageSkewEnforcement // +optional BootImageSkewEnforcementStatus BootImageSkewEnforcementStatus `json:"bootImageSkewEnforcementStatus,omitempty,omitzero"` } @@ -398,6 +400,8 @@ type MachineManagerSelector struct { // Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. // Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. // None means that every resource matched by the machine manager will not be updated. + // When boot image skew enforcement is in Automatic mode, only All is permitted for the + // machinesets and machinedeployments resource types, in any API group. // +unionDiscriminator // +required Mode MachineManagerSelectorMode `json:"mode"` diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go index 2d4102745119..be972585d9e8 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go @@ -1055,6 +1055,44 @@ func (in *Console) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleAuthProxyConfig) DeepCopyInto(out *ConsoleAuthProxyConfig) { + *out = *in + if in.NoProxy != nil { + in, out := &in.NoProxy, &out.NoProxy + *out = make([]string, len(*in)) + copy(*out, *in) + } + out.TrustedCA = in.TrustedCA + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleAuthProxyConfig. +func (in *ConsoleAuthProxyConfig) DeepCopy() *ConsoleAuthProxyConfig { + if in == nil { + return nil + } + out := new(ConsoleAuthProxyConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleAuthProxyTrustedCAConfigMapReference) DeepCopyInto(out *ConsoleAuthProxyTrustedCAConfigMapReference) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleAuthProxyTrustedCAConfigMapReference. +func (in *ConsoleAuthProxyTrustedCAConfigMapReference) DeepCopy() *ConsoleAuthProxyTrustedCAConfigMapReference { + if in == nil { + return nil + } + out := new(ConsoleAuthProxyTrustedCAConfigMapReference) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ConsoleConfigRoute) DeepCopyInto(out *ConsoleConfigRoute) { *out = *in @@ -1112,6 +1150,22 @@ func (in *ConsoleCustomization) DeepCopy() *ConsoleCustomization { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ConsoleIngress) DeepCopyInto(out *ConsoleIngress) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsoleIngress. +func (in *ConsoleIngress) DeepCopy() *ConsoleIngress { + if in == nil { + return nil + } + out := new(ConsoleIngress) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ConsoleList) DeepCopyInto(out *ConsoleList) { *out = *in @@ -1170,6 +1224,7 @@ func (in *ConsoleProviders) DeepCopy() *ConsoleProviders { func (in *ConsoleSpec) DeepCopyInto(out *ConsoleSpec) { *out = *in in.OperatorSpec.DeepCopyInto(&out.OperatorSpec) + in.AuthProxy.DeepCopyInto(&out.AuthProxy) in.Customization.DeepCopyInto(&out.Customization) in.Providers.DeepCopyInto(&out.Providers) out.Route = in.Route @@ -1861,6 +1916,22 @@ func (in *GCPLoadBalancerParameters) DeepCopy() *GCPLoadBalancerParameters { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GatewayAPIIngressConfig) DeepCopyInto(out *GatewayAPIIngressConfig) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIIngressConfig. +func (in *GatewayAPIIngressConfig) DeepCopy() *GatewayAPIIngressConfig { + if in == nil { + return nil + } + out := new(GatewayAPIIngressConfig) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *GatewayConfig) DeepCopyInto(out *GatewayConfig) { *out = *in @@ -2201,6 +2272,10 @@ func (in *IPv6OVNKubernetesConfig) DeepCopy() *IPv6OVNKubernetesConfig { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Ingress) DeepCopyInto(out *Ingress) { *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + out.Spec = in.Spec + in.Status.DeepCopyInto(&out.Status) return } @@ -2214,6 +2289,14 @@ func (in *Ingress) DeepCopy() *Ingress { return out } +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *Ingress) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *IngressController) DeepCopyInto(out *IngressController) { *out = *in @@ -2670,6 +2753,79 @@ func (in *IngressControllerTuningOptions) DeepCopy() *IngressControllerTuningOpt return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressList) DeepCopyInto(out *IngressList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]Ingress, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressList. +func (in *IngressList) DeepCopy() *IngressList { + if in == nil { + return nil + } + out := new(IngressList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *IngressList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressSpec) DeepCopyInto(out *IngressSpec) { + *out = *in + out.GatewayAPI = in.GatewayAPI + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressSpec. +func (in *IngressSpec) DeepCopy() *IngressSpec { + if in == nil { + return nil + } + out := new(IngressSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *IngressStatus) DeepCopyInto(out *IngressStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]metav1.Condition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressStatus. +func (in *IngressStatus) DeepCopy() *IngressStatus { + if in == nil { + return nil + } + out := new(IngressStatus) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *InsightsOperator) DeepCopyInto(out *InsightsOperator) { *out = *in diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml index 083bf4940c29..a5750a18bb2b 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml @@ -114,7 +114,8 @@ consoles.operator.openshift.io: CRDName: consoles.operator.openshift.io Capability: "" Category: "" - FeatureGates: [] + FeatureGates: + - AuthenticationComponentProxyExternalOIDC FilenameOperatorName: console FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_50" @@ -172,6 +173,29 @@ etcds.operator.openshift.io: TopLevelFeatureGates: [] Version: v1 +ingresses.operator.openshift.io: + Annotations: {} + ApprovedPRNumber: https://github.com/openshift/api/pull/2890 + CRDName: ingresses.operator.openshift.io + Capability: Ingress + Category: "" + FeatureGates: + - GatewayAPIManagementMode + FilenameOperatorName: ingress + FilenameOperatorOrdering: "02" + FilenameRunLevel: "0000_50" + GroupName: operator.openshift.io + HasStatus: true + KindName: Ingress + Labels: {} + PluralName: ingresses + PrinterColumns: [] + Scope: Cluster + ShortNames: null + TopLevelFeatureGates: + - GatewayAPIManagementMode + Version: v1 + ingresscontrollers.operator.openshift.io: Annotations: {} ApprovedPRNumber: https://github.com/openshift/api/pull/616 @@ -311,7 +335,6 @@ machineconfigurations.operator.openshift.io: Capability: "" Category: "" FeatureGates: - - BootImageSkewEnforcement - IrreconcilableMachineConfig - ManagedBootImagesAWSCAPI - ManagedBootImagesCPMS diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go index 13ab0c5f6f29..37218e6dafb9 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go @@ -240,6 +240,16 @@ func (in Console) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.Console" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleAuthProxyConfig) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleAuthProxyConfig" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleAuthProxyTrustedCAConfigMapReference) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleAuthProxyTrustedCAConfigMapReference" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in ConsoleConfigRoute) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleConfigRoute" @@ -250,6 +260,11 @@ func (in ConsoleCustomization) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleCustomization" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in ConsoleIngress) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.ConsoleIngress" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in ConsoleList) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.ConsoleList" @@ -410,6 +425,11 @@ func (in GCPLoadBalancerParameters) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.GCPLoadBalancerParameters" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in GatewayAPIIngressConfig) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.GatewayAPIIngressConfig" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in GatewayConfig) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.GatewayConfig" @@ -585,6 +605,21 @@ func (in IngressControllerTuningOptions) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.IngressControllerTuningOptions" } +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressList) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressList" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressSpec) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressSpec" +} + +// OpenAPIModelName returns the OpenAPI model name for this type. +func (in IngressStatus) OpenAPIModelName() string { + return "com.github.openshift.api.operator.v1.IngressStatus" +} + // OpenAPIModelName returns the OpenAPI model name for this type. func (in InsightsOperator) OpenAPIModelName() string { return "com.github.openshift.api.operator.v1.InsightsOperator" diff --git a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go index 309d84b07256..44f1a292c42c 100644 --- a/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go @@ -277,6 +277,27 @@ func (Console) SwaggerDoc() map[string]string { return map_Console } +var map_ConsoleAuthProxyConfig = map[string]string{ + "": "ConsoleAuthProxyConfig holds proxy configuration scoped to Console's OIDC login clients. At least one of httpProxy or httpsProxy must be specified.", + "httpProxy": "httpProxy is the URL of the proxy for HTTP requests. Must be a valid URL with http or https scheme, a non-empty hostname, and no path, query parameters, or fragment. Userinfo (e.g. user:password@host) is allowed for proxy authentication. Maximum length is 2048 characters.", + "httpsProxy": "httpsProxy is the URL of the proxy for HTTPS requests. Must be a valid URL with http or https scheme, a non-empty hostname, and no path, query parameters, or fragment. Userinfo (e.g. user:password@host) is allowed for proxy authentication. Maximum length is 2048 characters.", + "noProxy": "noProxy is a list of hostnames and/or CIDRs and/or IPs for which the proxy should not be used. Must contain at least one entry when set. Each entry must be between 1 and 253 characters long and at most 64 entries are allowed. Duplicate entries are not permitted. Entries that are not valid hostnames, CIDRs, or IPs are silently ignored. Cluster-internal defaults (.cluster.local, .svc, 127.0.0.1, localhost) are always appended automatically and do not need to be included.", + "trustedCA": "trustedCA is a reference to a ConfigMap in the openshift-config namespace containing a CA certificate bundle under the key \"ca-bundle.crt\". This bundle is appended to the system trust store used by Console's OIDC login clients for proxy TLS connections. When omitted, only the system trust store is used.", +} + +func (ConsoleAuthProxyConfig) SwaggerDoc() map[string]string { + return map_ConsoleAuthProxyConfig +} + +var map_ConsoleAuthProxyTrustedCAConfigMapReference = map[string]string{ + "": "ConsoleAuthProxyTrustedCAConfigMapReference references a ConfigMap in the openshift-config namespace.", + "name": "name is the metadata.name of the referenced ConfigMap. Must be a valid DNS subdomain name (RFC 1123): at most 253 characters, only lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character.", +} + +func (ConsoleAuthProxyTrustedCAConfigMapReference) SwaggerDoc() map[string]string { + return map_ConsoleAuthProxyTrustedCAConfigMapReference +} + var map_ConsoleConfigRoute = map[string]string{ "": "ConsoleConfigRoute holds information on external route access to console. DEPRECATED", "hostname": "hostname is the desired custom domain under which console will be available.", @@ -306,6 +327,16 @@ func (ConsoleCustomization) SwaggerDoc() map[string]string { return map_ConsoleCustomization } +var map_ConsoleIngress = map[string]string{ + "": "Ingress allows cluster admin to configure alternative ingress for the console.", + "consoleURL": "consoleURL is a URL to be used as the base console address. If not specified, the console route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. Make sure that appropriate ingress is set up at this URL. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", + "clientDownloadsURL": "clientDownloadsURL is a URL to be used as the address to download client binaries. If not specified, the downloads route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", +} + +func (ConsoleIngress) SwaggerDoc() map[string]string { + return map_ConsoleIngress +} + var map_ConsoleList = map[string]string{ "": "Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", @@ -326,6 +357,7 @@ func (ConsoleProviders) SwaggerDoc() map[string]string { var map_ConsoleSpec = map[string]string{ "": "ConsoleSpec is the specification of the desired behavior of the Console.", + "authProxy": "authProxy configures proxy settings for outbound connections made by Console's OIDC login clients, including discovery, JWKS retrieval, code exchange, and token refresh. When set, it replaces the cluster-wide proxy (proxy.config.openshift.io/cluster) entirely for these connections; individual fields are not inherited from the cluster-wide configuration. At least one of httpProxy or httpsProxy must be specified. When omitted, the cluster-wide proxy is used if configured; otherwise no proxy is used. Other Console clients retain their existing proxy settings.", "customization": "customization is used to optionally provide a small set of customization options to the web console.", "providers": "providers contains configuration for using specific service providers.", "route": "route contains hostname and secret reference that contains the serving certificate. If a custom route is specified, a new route will be created with the provided hostname, under which console will be available. In case of custom hostname uses the default routing suffix of the cluster, the Secret specification for a serving certificate will not be needed. In case of custom hostname points to an arbitrary domain, manual DNS configurations steps are necessary. The default console route will be maintained to reserve the default hostname for console if the custom route is removed. If not specified, default route will be used. DEPRECATED", @@ -396,16 +428,6 @@ func (FileReferenceSource) SwaggerDoc() map[string]string { return map_FileReferenceSource } -var map_Ingress = map[string]string{ - "": "Ingress allows cluster admin to configure alternative ingress for the console.", - "consoleURL": "consoleURL is a URL to be used as the base console address. If not specified, the console route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. Make sure that appropriate ingress is set up at this URL. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", - "clientDownloadsURL": "clientDownloadsURL is a URL to be used as the address to download client binaries. If not specified, the downloads route hostname will be used. This field is required for clusters without ingress capability, where access to routes is not possible. The console operator will monitor the URL and may go degraded if it's unreachable for an extended period. Must use the HTTPS scheme.", -} - -func (Ingress) SwaggerDoc() map[string]string { - return map_Ingress -} - var map_Logo = map[string]string{ "": "Logo defines a configuration based on theme modes for the console UI logo.", "type": "type specifies the type of the logo for the console UI. It determines whether the logo is for the masthead or favicon. type is a required field that allows values of Masthead and Favicon. When set to \"Masthead\", the logo will be used in the masthead and about modal of the console UI. When set to \"Favicon\", the logo will be used as the favicon of the console UI.", @@ -895,6 +917,55 @@ func (EtcdSpec) SwaggerDoc() map[string]string { return map_EtcdSpec } +var map_GatewayAPIIngressConfig = map[string]string{ + "": "GatewayAPIIngressConfig holds configuration for Gateway API integration in the Cluster Ingress Operator.", + "managementMode": "managementMode specifies how the Cluster Ingress Operator manages Gateway API Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, and its Gateway API controllers.\n\nAllowed values are \"Managed\" and \"Unmanaged\".\n\nWhen omitted or set to \"Managed\", the ingress operator installs, owns, and upgrades the Gateway API CRDs, protects them with a Validating Admission Policy, and deploys the OpenShift Gateway API implementation and its Gateway API controllers.\n\nWhen set to \"Unmanaged\", the ingress operator does not install or manage Gateway API CRDs and does not deploy the OpenShift Gateway API implementation or its Gateway API controllers. The cluster administrator or a third-party product is responsible for providing their own CRDs and Gateway controller. The ingress operator reports observational status only.", +} + +func (GatewayAPIIngressConfig) SwaggerDoc() map[string]string { + return map_GatewayAPIIngressConfig +} + +var map_Ingress = map[string]string{ + "": "Ingress contains configuration options specific to the Ingress Operator itself, including how it manages Gateway API integration.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "spec": "spec holds user settable values for configuration.", + "status": "status holds observed values from the cluster.", +} + +func (Ingress) SwaggerDoc() map[string]string { + return map_Ingress +} + +var map_IngressList = map[string]string{ + "": "IngressList is a collection of Ingresses.\n\nCompatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).", + "metadata": "metadata is the standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata", + "items": "items is a list of Ingresses.", +} + +func (IngressList) SwaggerDoc() map[string]string { + return map_IngressList +} + +var map_IngressSpec = map[string]string{ + "": "IngressSpec is the specification of the desired behavior of the Ingress Operator.", + "gatewayAPI": "gatewayAPI holds configuration for Gateway API integration, including how the ingress operator manages Gateway API CRDs, the OpenShift Gateway API implementation, and its Gateway API controllers.", +} + +func (IngressSpec) SwaggerDoc() map[string]string { + return map_IngressSpec +} + +var map_IngressStatus = map[string]string{ + "": "IngressStatus defines the observed status of the Ingress Operator.", + "conditions": "conditions is a list of conditions and their status.\n\nGateway API CRD management conditions are reported here with the \"GatewayAPI\" prefix:\n\n* \"GatewayAPICRDsManaged\" indicates whether the ingress operator is actively\n managing Gateway API CRDs.\n* \"GatewayAPICRDsPresent\" indicates whether Gateway API CRDs exist on the\n cluster.\n* \"GatewayAPICRDsCompliant\" indicates whether the installed CRDs match the\n version expected by this ingress operator release.", + "observedGeneration": "observedGeneration represents the most recent generation observed by the operator and specifies the version of the spec field currently being synced.\n\nWhen omitted, the operator has not yet observed the resource.", +} + +func (IngressStatus) SwaggerDoc() map[string]string { + return map_IngressStatus +} + var map_AWSClassicLoadBalancerParameters = map[string]string{ "": "AWSClassicLoadBalancerParameters holds configuration parameters for an AWS Classic load balancer.", "connectionIdleTimeout": "connectionIdleTimeout specifies the maximum time period that a connection may be idle before the load balancer closes the connection. The value must be parseable as a time duration value; see . A nil or zero value means no opinion, in which case a default value is used. The default value for this field is 60s. This default is subject to change.", @@ -1174,7 +1245,7 @@ var map_IngressControllerSpec = map[string]string{ "httpCompression": "httpCompression defines a policy for HTTP traffic compression. By default, there is no HTTP compression.", "idleConnectionTerminationPolicy": "idleConnectionTerminationPolicy maps directly to HAProxy's idle-close-on-response option and controls whether HAProxy keeps idle frontend connections open during a soft stop (router reload).\n\nAllowed values for this field are \"Immediate\" and \"Deferred\". The default value is \"Immediate\".\n\nWhen set to \"Immediate\", idle connections are closed immediately during router reloads. This ensures immediate propagation of route changes but may impact clients sensitive to connection resets.\n\nWhen set to \"Deferred\", HAProxy will maintain idle connections during a soft reload instead of closing them immediately. These connections remain open until any of the following occurs:\n\n - A new request is received on the connection, in which\n case HAProxy handles it in the old process and closes\n the connection after sending the response.\n\n - HAProxy's `timeout http-keep-alive` duration expires.\n By default this is 300 seconds, but it can be changed\n using httpKeepAliveTimeout tuning option.\n\n - The client's keep-alive timeout expires, causing the\n client to close the connection.\n\nSetting Deferred can help prevent errors in clients or load balancers that do not properly handle connection resets. Additionally, this option allows you to retain the pre-2.4 HAProxy behaviour: in HAProxy version 2.2 (OpenShift versions < 4.14), maintaining idle connections during a soft reload was the default behaviour, but starting with HAProxy 2.4, the default changed to closing idle connections immediately.\n\nImportant Consideration:\n\n - Using Deferred will result in temporary inconsistencies\n for the first request on each persistent connection\n after a route update and router reload. This request\n will be processed by the old HAProxy process using its\n old configuration. Subsequent requests will use the\n updated configuration.\n\nOperational Considerations:\n\n - Keeping idle connections open during reloads may lead\n to an accumulation of old HAProxy processes if\n connections remain idle for extended periods,\n especially in environments where frequent reloads\n occur.\n\n - Consider monitoring the number of HAProxy processes in\n the router pods when Deferred is set.\n\n - You may need to enable or adjust the\n `ingress.operator.openshift.io/hard-stop-after`\n duration (configured via an annotation on the\n IngressController resource) in environments with\n frequent reloads to prevent resource exhaustion.", "closedClientConnectionPolicy": "closedClientConnectionPolicy controls how the IngressController behaves when the client closes the TCP connection while the TLS handshake or HTTP request is in progress. This option maps directly to HAProxy’s \"abortonclose\" option.\n\nValid values are: \"Abort\" and \"Continue\". The default value is \"Continue\".\n\nWhen set to \"Abort\", the router will stop processing the TLS handshake if it is in progress, and it will not send an HTTP request to the backend server if the request has not yet been sent when the client closes the connection.\n\nWhen set to \"Continue\", the router will complete the TLS handshake if it is in progress, or send an HTTP request to the backend server and wait for the backend server's response, regardless of whether the client has closed the connection.\n\nSetting \"Abort\" can help free CPU resources otherwise spent on TLS computation for connections the client has already closed, and can reduce request queue size, thereby reducing the load on saturated backend servers.\n\nImportant Considerations:\n\n - The default policy (\"Continue\") is HTTP-compliant, and requests\n for aborted client connections will still be served.\n Use the \"Continue\" policy to allow a client to send a request\n and then immediately close its side of the connection while\n still receiving a response on the half-closed connection.\n\n - When clients use keep-alive connections, the most common case for premature\n closure is when the user wants to cancel the transfer or when a timeout\n occurs. In that case, the \"Abort\" policy may be used to reduce resource consumption.\n\n - Using RSA keys larger than 2048 bits can significantly slow down\n TLS computations. Consider using the \"Abort\" policy to reduce CPU usage.", - "haproxyVersion": "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nOpenShift 5.0 introduces HAProxy 3.2 as its default version and supports HAProxy 2.8 from OpenShift 4.22 for migration purposes. When an OpenShift release introduces a new default HAProxy version, that HAProxy version becomes available as a pinnable value in subsequent OpenShift releases, providing a smooth migration path for administrators who want to defer HAProxy upgrades.\n\nValid values for OpenShift 5.0: - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.0) - \"3.2\": Explicitly pins HAProxy 3.2 for preservation during cluster\n upgrades to future OpenShift releases\n- \"2.8\": Uses HAProxy 2.8 from OpenShift 4.22 (migration support, will\n be dropped in the next OpenShift release)\n\nIf a specific HAProxy version is set and would become unsupported in a target cluster upgrade, a preflight check will block the cluster upgrade until this field is updated to unset or a supported version.", + "haproxyVersion": "haproxyVersion specifies the HAProxy version to use for this IngressController.\n\nOpenShift 5.1 uses HAProxy 3.2 as its default version and supports HAProxy 3.4 as an explicit, non-default opt-in.\n\nValid values for OpenShift 5.1: - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.1) - \"3.2\": Uses the latest HAProxy 3.2.z available for this OpenShift release and pins the minor version. - \"3.4\": Uses the latest HAProxy 3.4.z available for this OpenShift release. This is an explicit opt-in; HAProxy 3.4 is not the default.\n\nPlanned lifecycle for later OpenShift releases: - OpenShift 5.2 plans to make HAProxy 3.4 the default when this field is unset, while continuing to support \"3.2\" as an explicit selection. - OpenShift 5.3 plans to retire support for selecting HAProxy 3.2.\n\nNote: HAProxy 2.8 support has been dropped in OpenShift 5.1. Upgrading from OpenShift 5.0 with haproxyVersion set to \"2.8\" is blocked.\n\nIf a specific HAProxy version is set and would become unsupported in a target cluster upgrade, a preflight check will block the cluster upgrade until this field is updated to unset or a supported version.", } func (IngressControllerSpec) SwaggerDoc() map[string]string { @@ -1192,7 +1263,7 @@ var map_IngressControllerStatus = map[string]string{ "observedGeneration": "observedGeneration is the most recent generation observed.", "namespaceSelector": "namespaceSelector is the actual namespaceSelector in use.", "routeSelector": "routeSelector is the actual routeSelector in use.", - "effectiveHAProxyVersion": "effectiveHAProxyVersion reports the HAProxy version currently in use by this IngressController. This reflects the resolved value of the spec.haproxyVersion field. When omitted, the effective value has not yet been resolved by the operator or the feature is not enabled for this cluster.\n\nExamples for OpenShift 5.0: - \"3.2\": Using HAProxy 3.2 - \"2.8\": Using HAProxy 2.8", + "effectiveHAProxyVersion": "effectiveHAProxyVersion reports the HAProxy version currently in use by this IngressController. This reflects the resolved value of the spec.haproxyVersion field. When omitted, the effective value has not yet been resolved by the operator or the feature is not enabled for this cluster.\n\nExamples for OpenShift 5.1: - \"3.2\": Using the default HAProxy 3.2 - \"3.4\": Using the explicitly selected, non-default HAProxy 3.4\n\nPlanned lifecycle for later OpenShift releases: - OpenShift 5.2 plans to make HAProxy 3.4 the default while keeping HAProxy 3.2 selectable. - OpenShift 5.3 plans to retire HAProxy 3.2.", } func (IngressControllerStatus) SwaggerDoc() map[string]string { @@ -1426,7 +1497,7 @@ var map_KMSPreflightResult = map[string]string{ "": "KMSPreflightResult contains the outcome of a preflight validation.", "status": "status indicates the outcome of the preflight check. Succeeded means the KMS plugin responded to Status, Encrypt, and Decrypt calls successfully. Failed means the validation did not pass.", "configHash": "configHash is the hash of the configuration that was validated. This is compared against observedConfigHash to confirm the result corresponds to the current configuration. The value must be exactly 8 characters.", - "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. The value must be between 1 and 1024 characters.", + "remoteKeyID": "remoteKeyID is the remote key encryption key identifier from KMS v2 StatusResponse.key_id. This is not a cryptographic key, but a unique representation of the remote key used to encrypt data. When omitted, no remote key identifier is available. This is expected when status is Failed, for example when the KMS provider could not be reached. When status is Succeeded, remoteKeyID is required. When set, the value must be between 1 and 1024 characters.", } func (KMSPreflightResult) SwaggerDoc() map[string]string { @@ -1635,7 +1706,7 @@ func (MachineManager) SwaggerDoc() map[string]string { } var map_MachineManagerSelector = map[string]string{ - "mode": "mode determines how machine managers will be selected for updates. Valid values are All, Partial and None. All means that every resource matched by the machine manager will be updated. Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. None means that every resource matched by the machine manager will not be updated.", + "mode": "mode determines how machine managers will be selected for updates. Valid values are All, Partial and None. All means that every resource matched by the machine manager will be updated. Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. None means that every resource matched by the machine manager will not be updated. When boot image skew enforcement is in Automatic mode, only All is permitted for the machinesets and machinedeployments resource types, in any API group.", "partial": "partial provides label selector(s) that can be used to match machine management resources. Only permitted when mode is set to \"Partial\".", } diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go b/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go index 291cedc14558..ea7c23303dce 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go +++ b/vendor/github.com/openshift/api/operator/v1alpha1/types_clusterapi.go @@ -12,8 +12,8 @@ import ( // +kubebuilder:subresource:status // +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2564 // +openshift:file-pattern=cvoRunLevel=0000_30,operatorName=cluster-api,operatorOrdering=01 -// +openshift:enable:FeatureGate=ClusterAPIMachineManagement -// +kubebuilder:metadata:annotations="release.openshift.io/feature-gate=ClusterAPIMachineManagement" +// +openshift:enable:FeatureGate=ClusterAPIOperator +// +kubebuilder:metadata:annotations="release.openshift.io/feature-gate=ClusterAPIOperator" // ClusterAPI provides configuration for the capi-operator. // diff --git a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml index bb0d1025d499..851f99d97896 100644 --- a/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml +++ b/vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests.yaml @@ -1,12 +1,12 @@ clusterapis.operator.openshift.io: Annotations: - release.openshift.io/feature-gate: ClusterAPIMachineManagement + release.openshift.io/feature-gate: ClusterAPIOperator ApprovedPRNumber: https://github.com/openshift/api/pull/2564 CRDName: clusterapis.operator.openshift.io Capability: "" Category: "" FeatureGates: - - ClusterAPIMachineManagement + - ClusterAPIOperator FilenameOperatorName: cluster-api FilenameOperatorOrdering: "01" FilenameRunLevel: "0000_30" @@ -19,7 +19,7 @@ clusterapis.operator.openshift.io: Scope: Cluster ShortNames: null TopLevelFeatureGates: - - ClusterAPIMachineManagement + - ClusterAPIOperator Version: v1alpha1 clusterversionoperators.operator.openshift.io: diff --git a/vendor/github.com/openshift/api/route/v1/generated.proto b/vendor/github.com/openshift/api/route/v1/generated.proto index 28f8c311ee07..8de419bc3bd1 100644 --- a/vendor/github.com/openshift/api/route/v1/generated.proto +++ b/vendor/github.com/openshift/api/route/v1/generated.proto @@ -432,7 +432,8 @@ message TLSConfig { // key provides key file contents optional string key = 3; - // caCertificate provides the cert authority certificate contents + // caCertificate provides the cert authority certificate contents. Any needed + // intermediate certificates should be provided here. optional string caCertificate = 4; // destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt @@ -457,9 +458,12 @@ message TLSConfig { optional string insecureEdgeTerminationPolicy = 6; // externalCertificate provides certificate contents as a secret reference. - // This should be a single serving certificate, not a certificate - // chain. Do not include a CA certificate. The secret referenced should - // be present in the same namespace as that of the Route. + // This should be the serving certificate, and may optionally include the + // full certificate chain, including any needed intermediate certificates. + // There is no separate field to provide a CA certificate when using + // externalCertificate, so any CA certificate needed must be included as + // part of this chain. The secret referenced should be present in the same + // namespace as that of the Route. // Forbidden when `certificate` is set. // The router service account needs to be granted with read-only access to this secret, // please refer to openshift docs for additional details. diff --git a/vendor/github.com/openshift/api/route/v1/types.go b/vendor/github.com/openshift/api/route/v1/types.go index 41f362fdf411..685e9afae611 100644 --- a/vendor/github.com/openshift/api/route/v1/types.go +++ b/vendor/github.com/openshift/api/route/v1/types.go @@ -443,7 +443,8 @@ type TLSConfig struct { // key provides key file contents Key string `json:"key,omitempty" protobuf:"bytes,3,opt,name=key"` - // caCertificate provides the cert authority certificate contents + // caCertificate provides the cert authority certificate contents. Any needed + // intermediate certificates should be provided here. CACertificate string `json:"caCertificate,omitempty" protobuf:"bytes,4,opt,name=caCertificate"` // destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt @@ -468,9 +469,12 @@ type TLSConfig struct { InsecureEdgeTerminationPolicy InsecureEdgeTerminationPolicyType `json:"insecureEdgeTerminationPolicy,omitempty" protobuf:"bytes,6,opt,name=insecureEdgeTerminationPolicy,casttype=InsecureEdgeTerminationPolicyType"` // externalCertificate provides certificate contents as a secret reference. - // This should be a single serving certificate, not a certificate - // chain. Do not include a CA certificate. The secret referenced should - // be present in the same namespace as that of the Route. + // This should be the serving certificate, and may optionally include the + // full certificate chain, including any needed intermediate certificates. + // There is no separate field to provide a CA certificate when using + // externalCertificate, so any CA certificate needed must be included as + // part of this chain. The secret referenced should be present in the same + // namespace as that of the Route. // Forbidden when `certificate` is set. // The router service account needs to be granted with read-only access to this secret, // please refer to openshift docs for additional details. diff --git a/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go b/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go index 4c8f9eeddf3f..f7fda2cb8650 100644 --- a/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go +++ b/vendor/github.com/openshift/api/route/v1/zz_generated.swagger_doc_generated.go @@ -176,10 +176,10 @@ var map_TLSConfig = map[string]string{ "termination": "termination indicates the TLS termination type.\n\n* edge - TLS termination is done by the router and http is used to communicate with the backend (default)\n\n* passthrough - Traffic is sent straight to the destination without the router providing TLS termination\n\n* reencrypt - TLS termination is done by the router and https is used to communicate with the backend\n\nNote: passthrough termination is incompatible with httpHeader actions", "certificate": "certificate provides certificate contents. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate.", "key": "key provides key file contents", - "caCertificate": "caCertificate provides the cert authority certificate contents", + "caCertificate": "caCertificate provides the cert authority certificate contents. Any needed intermediate certificates should be provided here.", "destinationCACertificate": "destinationCACertificate provides the contents of the ca certificate of the final destination. When using reencrypt termination this file should be provided in order to have routers use it for health checks on the secure connection. If this field is not specified, the router may provide its own destination CA and perform hostname validation using the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically verify.", "insecureEdgeTerminationPolicy": "insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While each router may make its own decisions on which ports to expose, this is normally port 80.\n\nIf a route does not specify insecureEdgeTerminationPolicy, then the default behavior is \"None\".\n\n* Allow - traffic is sent to the server on the insecure port (edge/reencrypt terminations only).\n\n* None - no traffic is allowed on the insecure port (default).\n\n* Redirect - clients are redirected to the secure port.", - "externalCertificate": "externalCertificate provides certificate contents as a secret reference. This should be a single serving certificate, not a certificate chain. Do not include a CA certificate. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. The router service account needs to be granted with read-only access to this secret, please refer to openshift docs for additional details.", + "externalCertificate": "externalCertificate provides certificate contents as a secret reference. This should be the serving certificate, and may optionally include the full certificate chain, including any needed intermediate certificates. There is no separate field to provide a CA certificate when using externalCertificate, so any CA certificate needed must be included as part of this chain. The secret referenced should be present in the same namespace as that of the Route. Forbidden when `certificate` is set. The router service account needs to be granted with read-only access to this secret, please refer to openshift docs for additional details.", } func (TLSConfig) SwaggerDoc() map[string]string { diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go index 135e8568dd4e..087a1f252de9 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurespec.go @@ -37,6 +37,17 @@ type InfrastructureSpecApplyConfiguration struct { // // This value may be set to match status.controlPlaneTopology regardless of the current value. ControlPlaneTopology *configv1.TopologyMode `json:"controlPlaneTopology,omitempty"` + // infrastructureTopology expresses the desired topology for infrastructure + // services that do not run on control plane nodes, indicating how + // infrastructure workloads are distributed across nodes. + // + // When omitted, no topology transition override has been expressed. + // Once populated, the field represents the desired topology state. + // + // When the value differs from status.infrastructureTopology, the cluster + // evaluates whether the requested transition can proceed. Not all + // transitions may be permitted. + InfrastructureTopology *configv1.TopologyMode `json:"infrastructureTopology,omitempty"` } // InfrastructureSpecApplyConfiguration constructs a declarative configuration of the InfrastructureSpec type for use with @@ -68,3 +79,11 @@ func (b *InfrastructureSpecApplyConfiguration) WithControlPlaneTopology(value co b.ControlPlaneTopology = &value return b } + +// WithInfrastructureTopology sets the InfrastructureTopology field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the InfrastructureTopology field is set to the value of the last call. +func (b *InfrastructureSpecApplyConfiguration) WithInfrastructureTopology(value configv1.TopologyMode) *InfrastructureSpecApplyConfiguration { + b.InfrastructureTopology = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go index c01827c1130c..dbaa22c191a5 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/infrastructurestatus.go @@ -53,6 +53,13 @@ type InfrastructureStatusApplyConfiguration struct { // and the operators should not configure the operand for highly-available operation // NOTE: External topology mode is not applicable for this field. InfrastructureTopology *configv1.TopologyMode `json:"infrastructureTopology,omitempty"` + // topologyTransitionStatus reports evaluations of supported topology transitions + // and the status of a requested transition, if any. + // It is optional and is omitted until the topology controller reports transition status. + // A transition is requested through spec.controlPlaneTopology. The controller + // reports completion only after both topologies reach that transition's target + // and post-transition checks pass; reaching the target topology alone is not completion. + TopologyTransitionStatus *TopologyTransitionStatusApplyConfiguration `json:"topologyTransitionStatus,omitempty"` // cpuPartitioning expresses if CPU partitioning is a currently enabled feature in the cluster. // CPU Partitioning means that this cluster can support partitioning workloads to specific CPU Sets. // Valid values are "None" and "AllNodes". When omitted, the default value is "None". @@ -132,6 +139,14 @@ func (b *InfrastructureStatusApplyConfiguration) WithInfrastructureTopology(valu return b } +// WithTopologyTransitionStatus sets the TopologyTransitionStatus field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TopologyTransitionStatus field is set to the value of the last call. +func (b *InfrastructureStatusApplyConfiguration) WithTopologyTransitionStatus(value *TopologyTransitionStatusApplyConfiguration) *InfrastructureStatusApplyConfiguration { + b.TopologyTransitionStatus = value + return b +} + // WithCPUPartitioning sets the CPUPartitioning field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the CPUPartitioning field is set to the value of the last call. diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologystate.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologystate.go new file mode 100644 index 000000000000..aac97c817872 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologystate.go @@ -0,0 +1,59 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + configv1 "github.com/openshift/api/config/v1" +) + +// TopologyStateApplyConfiguration represents a declarative configuration of the TopologyState type for use +// with apply. +// +// TopologyState describes the control-plane and infrastructure topology at one +// end of a topology transition. +// The topology controller determines which transitions are supported. Currently, +// it supports only transitions that change both topologies from SingleReplica to +// HighlyAvailable. Representing a topology here does not enable a transition to it. +type TopologyStateApplyConfiguration struct { + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. HighlyAvailable means multiple instances are expected + // to provide redundancy. HighlyAvailableArbiter means two control-plane nodes + // and a smaller arbiter node to maintain quorum. + // See https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for + // topology definitions. + // controlPlaneTopology is required. + ControlPlaneTopology *configv1.TopologyMode `json:"controlPlaneTopology,omitempty"` + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // infrastructureTopology is required. + InfrastructureTopology *configv1.TopologyMode `json:"infrastructureTopology,omitempty"` +} + +// TopologyStateApplyConfiguration constructs a declarative configuration of the TopologyState type for use with +// apply. +func TopologyState() *TopologyStateApplyConfiguration { + return &TopologyStateApplyConfiguration{} +} + +// WithControlPlaneTopology sets the ControlPlaneTopology field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ControlPlaneTopology field is set to the value of the last call. +func (b *TopologyStateApplyConfiguration) WithControlPlaneTopology(value configv1.TopologyMode) *TopologyStateApplyConfiguration { + b.ControlPlaneTopology = &value + return b +} + +// WithInfrastructureTopology sets the InfrastructureTopology field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the InfrastructureTopology field is set to the value of the last call. +func (b *TopologyStateApplyConfiguration) WithInfrastructureTopology(value configv1.TopologyMode) *TopologyStateApplyConfiguration { + b.InfrastructureTopology = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransition.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransition.go new file mode 100644 index 000000000000..ae36bdbe6269 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransition.go @@ -0,0 +1,97 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + metav1 "k8s.io/client-go/applyconfigurations/meta/v1" +) + +// TopologyTransitionApplyConfiguration represents a declarative configuration of the TopologyTransition type for use +// with apply. +type TopologyTransitionApplyConfiguration struct { + // source is the control-plane and infrastructure topology this transition was + // evaluated from. It may differ from the current topology while status is + // being refreshed. External control planes cannot be a transition source. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // source is required. + Source *TopologyStateApplyConfiguration `json:"source,omitempty"` + // target is the control-plane and infrastructure topology this transition would + // move to. + // controlPlaneTopology is the topology of the control-plane nodes. Valid values + // are HighlyAvailable, HighlyAvailableArbiter, and SingleReplica. + // External is not valid: transitions cannot involve an externally hosted control plane. + // SingleReplica means a single instance of control-plane services is expected + // to meet cluster needs. + // HighlyAvailable means multiple instances are expected to provide redundancy. + // HighlyAvailableArbiter means two control-plane nodes and a smaller arbiter + // node to maintain quorum. See + // https://pkg.go.dev/github.com/openshift/api/config/v1#TopologyMode for topology definitions. + // infrastructureTopology is the topology of infrastructure services. Valid + // values are SingleReplica and HighlyAvailable. + // SingleReplica means operators expect a single instance of infrastructure + // services to meet cluster needs. + // HighlyAvailable means operators expect multiple instances of infrastructure + // services to provide redundancy. + // External control planes cannot be a transition target. + // target is required. + Target *TopologyStateApplyConfiguration `json:"target,omitempty"` + // evaluations contains the availability condition for this transition and + // conditions for the checks run against the cluster to determine availability. + // + // TopologyTransitionAvailable is required; other condition types report + // individual checks. Between one and 32 conditions must be present, allowing + // at most 31 individual checks in addition to the availability condition. + // The controller defines individual check types, reasons, and messages, and + // always reports each one explicitly, using Unknown when a check's result is + // not yet known. + Evaluations []metav1.ConditionApplyConfiguration `json:"evaluations,omitempty"` +} + +// TopologyTransitionApplyConfiguration constructs a declarative configuration of the TopologyTransition type for use with +// apply. +func TopologyTransition() *TopologyTransitionApplyConfiguration { + return &TopologyTransitionApplyConfiguration{} +} + +// WithSource sets the Source field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Source field is set to the value of the last call. +func (b *TopologyTransitionApplyConfiguration) WithSource(value *TopologyStateApplyConfiguration) *TopologyTransitionApplyConfiguration { + b.Source = value + return b +} + +// WithTarget sets the Target field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Target field is set to the value of the last call. +func (b *TopologyTransitionApplyConfiguration) WithTarget(value *TopologyStateApplyConfiguration) *TopologyTransitionApplyConfiguration { + b.Target = value + return b +} + +// WithEvaluations adds the given value to the Evaluations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Evaluations field. +func (b *TopologyTransitionApplyConfiguration) WithEvaluations(values ...*metav1.ConditionApplyConfiguration) *TopologyTransitionApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithEvaluations") + } + b.Evaluations = append(b.Evaluations, *values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransitionstatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransitionstatus.go new file mode 100644 index 000000000000..4c635aa6c6bb --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/topologytransitionstatus.go @@ -0,0 +1,67 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + metav1 "k8s.io/client-go/applyconfigurations/meta/v1" +) + +// TopologyTransitionStatusApplyConfiguration represents a declarative configuration of the TopologyTransitionStatus type for use +// with apply. +// +// TopologyTransitionStatus reports availability of each type of topology transition and contains the +// status of any initiated transition. +type TopologyTransitionStatusApplyConfiguration struct { + // conditions provides information on topology transition progress and the + // evaluation of supported transition types. The controller always reports both + // conditions once topologyTransitionStatus is set. + // + // Valid condition types are TopologyTransitionsEvaluated and + // TopologyTransitionCompleted. Both conditions must be present: the controller + // always reports each condition explicitly, using Unknown when a condition's + // state is not yet known, rather than omitting it. + Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"` + // transitions contains each supported transition type and its availability. + // It is optional. The controller clears this list whenever + // TopologyTransitionsEvaluated is not True, so its presence always reflects + // current, trustworthy results: an omitted list while TopologyTransitionsEvaluated + // is True means no supported transition options were found, and an omitted list + // otherwise means no transition options have been reported yet. + // + // Between one and eight transition options must be present when the list is set. + // This list reports transition options, not concurrent transitions. The topology + // controller determines which transition options are supported. + Transitions []TopologyTransitionApplyConfiguration `json:"transitions,omitempty"` +} + +// TopologyTransitionStatusApplyConfiguration constructs a declarative configuration of the TopologyTransitionStatus type for use with +// apply. +func TopologyTransitionStatus() *TopologyTransitionStatusApplyConfiguration { + return &TopologyTransitionStatusApplyConfiguration{} +} + +// WithConditions adds the given value to the Conditions field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Conditions field. +func (b *TopologyTransitionStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *TopologyTransitionStatusApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithConditions") + } + b.Conditions = append(b.Conditions, *values[i]) + } + return b +} + +// WithTransitions adds the given value to the Transitions field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Transitions field. +func (b *TopologyTransitionStatusApplyConfiguration) WithTransitions(values ...*TopologyTransitionApplyConfiguration) *TopologyTransitionStatusApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithTransitions") + } + b.Transitions = append(b.Transitions, *values[i]) + } + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfig.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanager.go similarity index 56% rename from vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfig.go rename to vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanager.go index 2e2228141840..ec889c7aa1fc 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfig.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanager.go @@ -11,87 +11,74 @@ import ( v1 "k8s.io/client-go/applyconfigurations/meta/v1" ) -// CRIOCredentialProviderConfigApplyConfiguration represents a declarative configuration of the CRIOCredentialProviderConfig type for use +// ControllerManagerApplyConfiguration represents a declarative configuration of the ControllerManager type for use // with apply. // -// CRIOCredentialProviderConfig holds cluster-wide singleton resource configurations for CRI-O credential provider, the name of this instance is "cluster". CRI-O credential provider is a binary shipped with CRI-O that provides a way to obtain container image pull credentials from external sources. -// For example, it can be used to fetch mirror registry credentials from secrets resources in the cluster within the same namespace the pod will be running in. -// CRIOCredentialProviderConfig configuration specifies the pod image sources registries that should trigger the CRI-O credential provider execution, which will resolve the CRI-O mirror configurations and obtain the necessary credentials for pod creation. -// Note: Configuration changes will only take effect after the kubelet restarts, which is automatically managed by the cluster during rollout. -// +// ControllerManager holds cluster-wide configuration shared by the controller managers +// in the system, among them especially kube-controller-manager. // The resource is a singleton named "cluster". // // Compatibility level 4: No compatibility is provided, the API can change at any point for any reason. These capabilities should not be used by applications needing long term support. -type CRIOCredentialProviderConfigApplyConfiguration struct { +type ControllerManagerApplyConfiguration struct { v1.TypeMetaApplyConfiguration `json:""` // metadata is the standard object's metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata *v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` - // spec defines the desired configuration of the CRI-O Credential Provider. - // This field is required and must be provided when creating the resource. - Spec *CRIOCredentialProviderConfigSpecApplyConfiguration `json:"spec,omitempty"` - // status represents the current state of the CRIOCredentialProviderConfig. - // When omitted or nil, it indicates that the status has not yet been set by the controller. - // The controller will populate this field with validation conditions and operational state. - Status *CRIOCredentialProviderConfigStatusApplyConfiguration `json:"status,omitempty"` + // spec holds user settable values for configuration. + // This field is required but the spec may be empty to express no opinion. + Spec *ControllerManagerSpecApplyConfiguration `json:"spec,omitempty"` } -// CRIOCredentialProviderConfig constructs a declarative configuration of the CRIOCredentialProviderConfig type for use with +// ControllerManager constructs a declarative configuration of the ControllerManager type for use with // apply. -func CRIOCredentialProviderConfig(name string) *CRIOCredentialProviderConfigApplyConfiguration { - b := &CRIOCredentialProviderConfigApplyConfiguration{} +func ControllerManager(name string) *ControllerManagerApplyConfiguration { + b := &ControllerManagerApplyConfiguration{} b.WithName(name) - b.WithKind("CRIOCredentialProviderConfig") + b.WithKind("ControllerManager") b.WithAPIVersion("config.openshift.io/v1alpha1") return b } -// ExtractCRIOCredentialProviderConfigFrom extracts the applied configuration owned by fieldManager from -// cRIOCredentialProviderConfig for the specified subresource. Pass an empty string for subresource to extract +// ExtractControllerManagerFrom extracts the applied configuration owned by fieldManager from +// controllerManager for the specified subresource. Pass an empty string for subresource to extract // the main resource. Common subresources include "status", "scale", etc. -// cRIOCredentialProviderConfig must be a unmodified CRIOCredentialProviderConfig API object that was retrieved from the Kubernetes API. -// ExtractCRIOCredentialProviderConfigFrom provides a way to perform a extract/modify-in-place/apply workflow. +// controllerManager must be a unmodified ControllerManager API object that was retrieved from the Kubernetes API. +// ExtractControllerManagerFrom provides a way to perform a extract/modify-in-place/apply workflow. // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously // applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractCRIOCredentialProviderConfigFrom(cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, fieldManager string, subresource string) (*CRIOCredentialProviderConfigApplyConfiguration, error) { - b := &CRIOCredentialProviderConfigApplyConfiguration{} - err := managedfields.ExtractInto(cRIOCredentialProviderConfig, internal.Parser().Type("com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfig"), fieldManager, b, subresource) +func ExtractControllerManagerFrom(controllerManager *configv1alpha1.ControllerManager, fieldManager string, subresource string) (*ControllerManagerApplyConfiguration, error) { + b := &ControllerManagerApplyConfiguration{} + err := managedfields.ExtractInto(controllerManager, internal.Parser().Type("com.github.openshift.api.config.v1alpha1.ControllerManager"), fieldManager, b, subresource) if err != nil { return nil, err } - b.WithName(cRIOCredentialProviderConfig.Name) + b.WithName(controllerManager.Name) - b.WithKind("CRIOCredentialProviderConfig") + b.WithKind("ControllerManager") b.WithAPIVersion("config.openshift.io/v1alpha1") return b, nil } -// ExtractCRIOCredentialProviderConfig extracts the applied configuration owned by fieldManager from -// cRIOCredentialProviderConfig. If no managedFields are found in cRIOCredentialProviderConfig for fieldManager, a -// CRIOCredentialProviderConfigApplyConfiguration is returned with only the Name, Namespace (if applicable), +// ExtractControllerManager extracts the applied configuration owned by fieldManager from +// controllerManager. If no managedFields are found in controllerManager for fieldManager, a +// ControllerManagerApplyConfiguration is returned with only the Name, Namespace (if applicable), // APIVersion and Kind populated. It is possible that no managed fields were found for because other // field managers have taken ownership of all the fields previously owned by fieldManager, or because // the fieldManager never owned fields any fields. -// cRIOCredentialProviderConfig must be a unmodified CRIOCredentialProviderConfig API object that was retrieved from the Kubernetes API. -// ExtractCRIOCredentialProviderConfig provides a way to perform a extract/modify-in-place/apply workflow. +// controllerManager must be a unmodified ControllerManager API object that was retrieved from the Kubernetes API. +// ExtractControllerManager provides a way to perform a extract/modify-in-place/apply workflow. // Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously // applied if another fieldManager has updated or force applied any of the previously applied fields. -func ExtractCRIOCredentialProviderConfig(cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, fieldManager string) (*CRIOCredentialProviderConfigApplyConfiguration, error) { - return ExtractCRIOCredentialProviderConfigFrom(cRIOCredentialProviderConfig, fieldManager, "") -} - -// ExtractCRIOCredentialProviderConfigStatus extracts the applied configuration owned by fieldManager from -// cRIOCredentialProviderConfig for the status subresource. -func ExtractCRIOCredentialProviderConfigStatus(cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, fieldManager string) (*CRIOCredentialProviderConfigApplyConfiguration, error) { - return ExtractCRIOCredentialProviderConfigFrom(cRIOCredentialProviderConfig, fieldManager, "status") +func ExtractControllerManager(controllerManager *configv1alpha1.ControllerManager, fieldManager string) (*ControllerManagerApplyConfiguration, error) { + return ExtractControllerManagerFrom(controllerManager, fieldManager, "") } -func (b CRIOCredentialProviderConfigApplyConfiguration) IsApplyConfiguration() {} +func (b ControllerManagerApplyConfiguration) IsApplyConfiguration() {} // WithKind sets the Kind field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Kind field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithKind(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithKind(value string) *ControllerManagerApplyConfiguration { b.TypeMetaApplyConfiguration.Kind = &value return b } @@ -99,7 +86,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithKind(value string) // WithAPIVersion sets the APIVersion field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the APIVersion field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithAPIVersion(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithAPIVersion(value string) *ControllerManagerApplyConfiguration { b.TypeMetaApplyConfiguration.APIVersion = &value return b } @@ -107,7 +94,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithAPIVersion(value st // WithName sets the Name field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Name field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithName(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithName(value string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.Name = &value return b @@ -116,7 +103,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithName(value string) // WithGenerateName sets the GenerateName field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the GenerateName field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithGenerateName(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithGenerateName(value string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.GenerateName = &value return b @@ -125,7 +112,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithGenerateName(value // WithNamespace sets the Namespace field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Namespace field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithNamespace(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithNamespace(value string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.Namespace = &value return b @@ -134,7 +121,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithNamespace(value str // WithUID sets the UID field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the UID field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithUID(value types.UID) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithUID(value types.UID) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.UID = &value return b @@ -143,7 +130,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithUID(value types.UID // WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the ResourceVersion field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithResourceVersion(value string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithResourceVersion(value string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.ResourceVersion = &value return b @@ -152,7 +139,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithResourceVersion(val // WithGeneration sets the Generation field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Generation field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithGeneration(value int64) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithGeneration(value int64) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.Generation = &value return b @@ -161,7 +148,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithGeneration(value in // WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the CreationTimestamp field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithCreationTimestamp(value metav1.Time) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithCreationTimestamp(value metav1.Time) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.CreationTimestamp = &value return b @@ -170,7 +157,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithCreationTimestamp(v // WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the DeletionTimestamp field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value return b @@ -179,7 +166,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithDeletionTimestamp(v // WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value return b @@ -189,7 +176,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithDeletionGracePeriod // and returns the receiver, so that objects can be build by chaining "With" function invocations. // If called multiple times, the entries provided by each call will be put on the Labels field, // overwriting an existing map entries in Labels field with the same key. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithLabels(entries map[string]string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithLabels(entries map[string]string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) @@ -204,7 +191,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithLabels(entries map[ // and returns the receiver, so that objects can be build by chaining "With" function invocations. // If called multiple times, the entries provided by each call will be put on the Annotations field, // overwriting an existing map entries in Annotations field with the same key. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithAnnotations(entries map[string]string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithAnnotations(entries map[string]string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) @@ -218,7 +205,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithAnnotations(entries // WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration // and returns the receiver, so that objects can be build by chaining "With" function invocations. // If called multiple times, values provided by each call will be appended to the OwnerReferences field. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() for i := range values { if values[i] == nil { @@ -232,7 +219,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithOwnerReferences(val // WithFinalizers adds the given value to the Finalizers field in the declarative configuration // and returns the receiver, so that objects can be build by chaining "With" function invocations. // If called multiple times, values provided by each call will be appended to the Finalizers field. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithFinalizers(values ...string) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithFinalizers(values ...string) *ControllerManagerApplyConfiguration { b.ensureObjectMetaApplyConfigurationExists() for i := range values { b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) @@ -240,7 +227,7 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) WithFinalizers(values . return b } -func (b *CRIOCredentialProviderConfigApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { +func (b *ControllerManagerApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { if b.ObjectMetaApplyConfiguration == nil { b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{} } @@ -249,37 +236,29 @@ func (b *CRIOCredentialProviderConfigApplyConfiguration) ensureObjectMetaApplyCo // WithSpec sets the Spec field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Spec field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithSpec(value *CRIOCredentialProviderConfigSpecApplyConfiguration) *CRIOCredentialProviderConfigApplyConfiguration { +func (b *ControllerManagerApplyConfiguration) WithSpec(value *ControllerManagerSpecApplyConfiguration) *ControllerManagerApplyConfiguration { b.Spec = value return b } -// WithStatus sets the Status field in the declarative configuration to the given value -// and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the Status field is set to the value of the last call. -func (b *CRIOCredentialProviderConfigApplyConfiguration) WithStatus(value *CRIOCredentialProviderConfigStatusApplyConfiguration) *CRIOCredentialProviderConfigApplyConfiguration { - b.Status = value - return b -} - // GetKind retrieves the value of the Kind field in the declarative configuration. -func (b *CRIOCredentialProviderConfigApplyConfiguration) GetKind() *string { +func (b *ControllerManagerApplyConfiguration) GetKind() *string { return b.TypeMetaApplyConfiguration.Kind } // GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. -func (b *CRIOCredentialProviderConfigApplyConfiguration) GetAPIVersion() *string { +func (b *ControllerManagerApplyConfiguration) GetAPIVersion() *string { return b.TypeMetaApplyConfiguration.APIVersion } // GetName retrieves the value of the Name field in the declarative configuration. -func (b *CRIOCredentialProviderConfigApplyConfiguration) GetName() *string { +func (b *ControllerManagerApplyConfiguration) GetName() *string { b.ensureObjectMetaApplyConfigurationExists() return b.ObjectMetaApplyConfiguration.Name } // GetNamespace retrieves the value of the Namespace field in the declarative configuration. -func (b *CRIOCredentialProviderConfigApplyConfiguration) GetNamespace() *string { +func (b *ControllerManagerApplyConfiguration) GetNamespace() *string { b.ensureObjectMetaApplyConfigurationExists() return b.ObjectMetaApplyConfiguration.Namespace } diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanagerspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanagerspec.go new file mode 100644 index 000000000000..be53e071ae6d --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/controllermanagerspec.go @@ -0,0 +1,49 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" +) + +// ControllerManagerSpecApplyConfiguration represents a declarative configuration of the ControllerManagerSpec type for use +// with apply. +// +// ControllerManagerSpec defines the desired state of the controller managers +type ControllerManagerSpecApplyConfiguration struct { + // volumeForceDetach controls the conditions under which kube-controller-manager + // force detaches volumes from a node that is not healthy. + // Volumes are always force detached when a node is marked out-of-service via the + // "node.kubernetes.io/out-of-service" taint, as part of the non-graceful node + // shutdown procedure. This field controls whether force detach is also triggered + // when the maximum unmount time is exceeded (6 minutes). + // Valid values are "OnUnmountTimeout" and "OnOutOfServiceTaintOnly". + // When set to "OnUnmountTimeout", volumes are force detached from unhealthy nodes + // once the maximum unmount time is exceeded, so that workloads using them can start + // on other nodes. Force detaching a volume that is still in use by the node can + // corrupt its data. + // When set to "OnOutOfServiceTaintOnly", volumes are force detached only via the + // out-of-service taint, and remain attached to an unhealthy node until it recovers + // or the "node.kubernetes.io/out-of-service" taint is applied as part of the + // non-graceful node shutdown procedure. + // When omitted, this means the user has no opinion and the platform is left + // to choose a reasonable default, which is subject to change over time. + // The current default is "OnUnmountTimeout". + // Changing this field causes kube-controller-manager to be redeployed with the new setting. + // Rollout progress is reported by the kube-controller-manager cluster operator. + VolumeForceDetach *configv1alpha1.VolumeForceDetachPolicy `json:"volumeForceDetach,omitempty"` +} + +// ControllerManagerSpecApplyConfiguration constructs a declarative configuration of the ControllerManagerSpec type for use with +// apply. +func ControllerManagerSpec() *ControllerManagerSpecApplyConfiguration { + return &ControllerManagerSpecApplyConfiguration{} +} + +// WithVolumeForceDetach sets the VolumeForceDetach field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the VolumeForceDetach field is set to the value of the last call. +func (b *ControllerManagerSpecApplyConfiguration) WithVolumeForceDetach(value configv1alpha1.VolumeForceDetachPolicy) *ControllerManagerSpecApplyConfiguration { + b.VolumeForceDetach = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigspec.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigspec.go deleted file mode 100644 index 6f37cef51af7..000000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigspec.go +++ /dev/null @@ -1,72 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" -) - -// CRIOCredentialProviderConfigSpecApplyConfiguration represents a declarative configuration of the CRIOCredentialProviderConfigSpec type for use -// with apply. -// -// CRIOCredentialProviderConfigSpec defines the desired configuration of the CRI-O Credential Provider. -type CRIOCredentialProviderConfigSpecApplyConfiguration struct { - // matchImages is a list of string patterns used to determine whether - // the CRI-O credential provider should be invoked for a given image. This list is - // passed to the kubelet CredentialProviderConfig, and if any pattern matches - // the requested image, CRI-O credential provider will be invoked to obtain credentials for pulling - // that image or its mirrors. - // Depending on the platform, the CRI-O credential provider may be installed alongside an existing platform specific provider. - // Conflicts between the existing platform specific provider image match configuration and this list will be handled by - // the following precedence rule: credentials from built-in kubelet providers (e.g., ECR, GCR, ACR) take precedence over those - // from the CRIOCredentialProviderConfig when both match the same image. - // To avoid uncertainty, it is recommended to avoid configuring your private image patterns to overlap with - // existing platform specific provider config(e.g., the entries from https://github.com/openshift/machine-config-operator/blob/main/templates/common/aws/files/etc-kubernetes-credential-providers-ecr-credential-provider.yaml). - // You can check the resource's Status conditions - // to see if any entries were ignored due to exact matches with known built-in provider patterns. - // - // This field is optional, the items of the list must contain between 1 and 50 entries. - // The list is treated as a set, so duplicate entries are not allowed. - // - // For more details, see: - // https://kubernetes.io/docs/tasks/administer-cluster/kubelet-credential-provider/ - // https://github.com/cri-o/crio-credential-provider#architecture - // - // Each entry in matchImages is a pattern which can optionally contain a port and a path. Each entry must be no longer than 512 characters. - // Wildcards ('*') are supported for full subdomain labels, such as '*.k8s.io' or 'k8s.*.io', - // and for top-level domains, such as 'k8s.*' (which matches 'k8s.io' or 'k8s.net'). - // A global wildcard '*' (matching any domain) is not allowed. - // Wildcards may replace an entire hostname label (e.g., *.example.com), but they cannot appear within a label (e.g., f*oo.example.com) and are not allowed in the port or path. - // For example, 'example.*.com' is valid, but 'exa*mple.*.com' is not. - // Each wildcard matches only a single domain label, - // so '*.io' does **not** match '*.k8s.io'. - // - // A match exists between an image and a matchImage when all of the below are true: - // Both contain the same number of domain parts and each part matches. - // The URL path of an matchImages must be a prefix of the target image URL path. - // If the matchImages contains a port, then the port must match in the image as well. - // - // Example values of matchImages: - // - 123456789.dkr.ecr.us-east-1.amazonaws.com - // - *.azurecr.io - // - gcr.io - // - *.*.registry.io - // - registry.io:8080/path - MatchImages []configv1alpha1.MatchImage `json:"matchImages,omitempty"` -} - -// CRIOCredentialProviderConfigSpecApplyConfiguration constructs a declarative configuration of the CRIOCredentialProviderConfigSpec type for use with -// apply. -func CRIOCredentialProviderConfigSpec() *CRIOCredentialProviderConfigSpecApplyConfiguration { - return &CRIOCredentialProviderConfigSpecApplyConfiguration{} -} - -// WithMatchImages adds the given value to the MatchImages field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the MatchImages field. -func (b *CRIOCredentialProviderConfigSpecApplyConfiguration) WithMatchImages(values ...configv1alpha1.MatchImage) *CRIOCredentialProviderConfigSpecApplyConfiguration { - for i := range values { - b.MatchImages = append(b.MatchImages, values[i]) - } - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigstatus.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigstatus.go deleted file mode 100644 index 090b044a5822..000000000000 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/criocredentialproviderconfigstatus.go +++ /dev/null @@ -1,41 +0,0 @@ -// Code generated by applyconfiguration-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - v1 "k8s.io/client-go/applyconfigurations/meta/v1" -) - -// CRIOCredentialProviderConfigStatusApplyConfiguration represents a declarative configuration of the CRIOCredentialProviderConfigStatus type for use -// with apply. -// -// CRIOCredentialProviderConfigStatus defines the observed state of CRIOCredentialProviderConfig -type CRIOCredentialProviderConfigStatusApplyConfiguration struct { - // conditions represent the latest available observations of the configuration state. - // When omitted, it indicates that no conditions have been reported yet. - // The maximum number of conditions is 16. - // Conditions are stored as a map keyed by condition type, ensuring uniqueness. - // - // Expected condition types include: - // "Validated": indicates whether the matchImages configuration is valid - Conditions []v1.ConditionApplyConfiguration `json:"conditions,omitempty"` -} - -// CRIOCredentialProviderConfigStatusApplyConfiguration constructs a declarative configuration of the CRIOCredentialProviderConfigStatus type for use with -// apply. -func CRIOCredentialProviderConfigStatus() *CRIOCredentialProviderConfigStatusApplyConfiguration { - return &CRIOCredentialProviderConfigStatusApplyConfiguration{} -} - -// WithConditions adds the given value to the Conditions field in the declarative configuration -// and returns the receiver, so that objects can be build by chaining "With" function invocations. -// If called multiple times, values provided by each call will be appended to the Conditions field. -func (b *CRIOCredentialProviderConfigStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *CRIOCredentialProviderConfigStatusApplyConfiguration { - for i := range values { - if values[i] == nil { - panic("nil value passed to WithConditions") - } - b.Conditions = append(b.Conditions, *values[i]) - } - return b -} diff --git a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go index ceceb8617804..a39cadb2b759 100644 --- a/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.go @@ -2146,6 +2146,9 @@ var schemaYAML = typed.YAMLObject(`types: - name: controlPlaneTopology type: scalar: string + - name: infrastructureTopology + type: + scalar: string - name: platformSpec type: namedType: com.github.openshift.api.config.v1.PlatformSpec @@ -2186,6 +2189,10 @@ var schemaYAML = typed.YAMLObject(`types: - name: platformStatus type: namedType: com.github.openshift.api.config.v1.PlatformStatus + - name: topologyTransitionStatus + type: + namedType: com.github.openshift.api.config.v1.TopologyTransitionStatus + default: {} - name: com.github.openshift.api.config.v1.Ingress map: fields: @@ -3992,6 +3999,51 @@ var schemaYAML = typed.YAMLObject(`types: - name: message type: scalar: string +- name: com.github.openshift.api.config.v1.TopologyState + map: + fields: + - name: controlPlaneTopology + type: + scalar: string + - name: infrastructureTopology + type: + scalar: string +- name: com.github.openshift.api.config.v1.TopologyTransition + map: + fields: + - name: evaluations + type: + list: + elementType: + namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + elementRelationship: associative + keys: + - type + - name: source + type: + namedType: com.github.openshift.api.config.v1.TopologyState + default: {} + - name: target + type: + namedType: com.github.openshift.api.config.v1.TopologyState + default: {} +- name: com.github.openshift.api.config.v1.TopologyTransitionStatus + map: + fields: + - name: conditions + type: + list: + elementType: + namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + elementRelationship: associative + keys: + - type + - name: transitions + type: + list: + elementType: + namedType: com.github.openshift.api.config.v1.TopologyTransition + elementRelationship: atomic - name: com.github.openshift.api.config.v1.Update map: fields: @@ -4475,46 +4527,6 @@ var schemaYAML = typed.YAMLObject(`types: type: namedType: com.github.openshift.api.config.v1alpha1.SecretKeySelector default: {} -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfig - map: - fields: - - name: apiVersion - type: - scalar: string - - name: kind - type: - scalar: string - - name: metadata - type: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta - default: {} - - name: spec - type: - namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec - - name: status - type: - namedType: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus - default: {} -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigSpec - map: - fields: - - name: matchImages - type: - list: - elementType: - scalar: string - elementRelationship: associative -- name: com.github.openshift.api.config.v1alpha1.CRIOCredentialProviderConfigStatus - map: - fields: - - name: conditions - type: - list: - elementType: - namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition - elementRelationship: associative - keys: - - type - name: com.github.openshift.api.config.v1alpha1.CertificateConfig map: fields: @@ -4618,6 +4630,28 @@ var schemaYAML = typed.YAMLObject(`types: - name: request type: namedType: io.k8s.apimachinery.pkg.api.resource.Quantity +- name: com.github.openshift.api.config.v1alpha1.ControllerManager + map: + fields: + - name: apiVersion + type: + scalar: string + - name: kind + type: + scalar: string + - name: metadata + type: + namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + default: {} + - name: spec + type: + namedType: com.github.openshift.api.config.v1alpha1.ControllerManagerSpec +- name: com.github.openshift.api.config.v1alpha1.ControllerManagerSpec + map: + fields: + - name: volumeForceDetach + type: + scalar: string - name: com.github.openshift.api.config.v1alpha1.CustomPKIPolicy map: fields: diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go index 23ba9a19c019..ac7bc9ba59f8 100644 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go +++ b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/config_client.go @@ -13,8 +13,8 @@ import ( type ConfigV1alpha1Interface interface { RESTClient() rest.Interface BackupsGetter - CRIOCredentialProviderConfigsGetter ClusterMonitoringsGetter + ControllerManagersGetter InsightsDataGathersGetter PKIsGetter } @@ -28,14 +28,14 @@ func (c *ConfigV1alpha1Client) Backups() BackupInterface { return newBackups(c) } -func (c *ConfigV1alpha1Client) CRIOCredentialProviderConfigs() CRIOCredentialProviderConfigInterface { - return newCRIOCredentialProviderConfigs(c) -} - func (c *ConfigV1alpha1Client) ClusterMonitorings() ClusterMonitoringInterface { return newClusterMonitorings(c) } +func (c *ConfigV1alpha1Client) ControllerManagers() ControllerManagerInterface { + return newControllerManagers(c) +} + func (c *ConfigV1alpha1Client) InsightsDataGathers() InsightsDataGatherInterface { return newInsightsDataGathers(c) } diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/controllermanager.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/controllermanager.go new file mode 100644 index 000000000000..7a69999f14e3 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/controllermanager.go @@ -0,0 +1,54 @@ +// Code generated by client-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + context "context" + + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + applyconfigurationsconfigv1alpha1 "github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1" + scheme "github.com/openshift/client-go/config/clientset/versioned/scheme" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + watch "k8s.io/apimachinery/pkg/watch" + gentype "k8s.io/client-go/gentype" +) + +// ControllerManagersGetter has a method to return a ControllerManagerInterface. +// A group's client should implement this interface. +type ControllerManagersGetter interface { + ControllerManagers() ControllerManagerInterface +} + +// ControllerManagerInterface has methods to work with ControllerManager resources. +type ControllerManagerInterface interface { + Create(ctx context.Context, controllerManager *configv1alpha1.ControllerManager, opts v1.CreateOptions) (*configv1alpha1.ControllerManager, error) + Update(ctx context.Context, controllerManager *configv1alpha1.ControllerManager, opts v1.UpdateOptions) (*configv1alpha1.ControllerManager, error) + Delete(ctx context.Context, name string, opts v1.DeleteOptions) error + DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error + Get(ctx context.Context, name string, opts v1.GetOptions) (*configv1alpha1.ControllerManager, error) + List(ctx context.Context, opts v1.ListOptions) (*configv1alpha1.ControllerManagerList, error) + Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) + Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *configv1alpha1.ControllerManager, err error) + Apply(ctx context.Context, controllerManager *applyconfigurationsconfigv1alpha1.ControllerManagerApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.ControllerManager, err error) + ControllerManagerExpansion +} + +// controllerManagers implements ControllerManagerInterface +type controllerManagers struct { + *gentype.ClientWithListAndApply[*configv1alpha1.ControllerManager, *configv1alpha1.ControllerManagerList, *applyconfigurationsconfigv1alpha1.ControllerManagerApplyConfiguration] +} + +// newControllerManagers returns a ControllerManagers +func newControllerManagers(c *ConfigV1alpha1Client) *controllerManagers { + return &controllerManagers{ + gentype.NewClientWithListAndApply[*configv1alpha1.ControllerManager, *configv1alpha1.ControllerManagerList, *applyconfigurationsconfigv1alpha1.ControllerManagerApplyConfiguration]( + "controllermanagers", + c.RESTClient(), + scheme.ParameterCodec, + "", + func() *configv1alpha1.ControllerManager { return &configv1alpha1.ControllerManager{} }, + func() *configv1alpha1.ControllerManagerList { return &configv1alpha1.ControllerManagerList{} }, + ), + } +} diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/criocredentialproviderconfig.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/criocredentialproviderconfig.go deleted file mode 100644 index 3c4962155a45..000000000000 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/criocredentialproviderconfig.go +++ /dev/null @@ -1,62 +0,0 @@ -// Code generated by client-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - context "context" - - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - applyconfigurationsconfigv1alpha1 "github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1" - scheme "github.com/openshift/client-go/config/clientset/versioned/scheme" - v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - types "k8s.io/apimachinery/pkg/types" - watch "k8s.io/apimachinery/pkg/watch" - gentype "k8s.io/client-go/gentype" -) - -// CRIOCredentialProviderConfigsGetter has a method to return a CRIOCredentialProviderConfigInterface. -// A group's client should implement this interface. -type CRIOCredentialProviderConfigsGetter interface { - CRIOCredentialProviderConfigs() CRIOCredentialProviderConfigInterface -} - -// CRIOCredentialProviderConfigInterface has methods to work with CRIOCredentialProviderConfig resources. -type CRIOCredentialProviderConfigInterface interface { - Create(ctx context.Context, cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, opts v1.CreateOptions) (*configv1alpha1.CRIOCredentialProviderConfig, error) - Update(ctx context.Context, cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, opts v1.UpdateOptions) (*configv1alpha1.CRIOCredentialProviderConfig, error) - // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus(). - UpdateStatus(ctx context.Context, cRIOCredentialProviderConfig *configv1alpha1.CRIOCredentialProviderConfig, opts v1.UpdateOptions) (*configv1alpha1.CRIOCredentialProviderConfig, error) - Delete(ctx context.Context, name string, opts v1.DeleteOptions) error - DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error - Get(ctx context.Context, name string, opts v1.GetOptions) (*configv1alpha1.CRIOCredentialProviderConfig, error) - List(ctx context.Context, opts v1.ListOptions) (*configv1alpha1.CRIOCredentialProviderConfigList, error) - Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) - Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *configv1alpha1.CRIOCredentialProviderConfig, err error) - Apply(ctx context.Context, cRIOCredentialProviderConfig *applyconfigurationsconfigv1alpha1.CRIOCredentialProviderConfigApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.CRIOCredentialProviderConfig, err error) - // Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus(). - ApplyStatus(ctx context.Context, cRIOCredentialProviderConfig *applyconfigurationsconfigv1alpha1.CRIOCredentialProviderConfigApplyConfiguration, opts v1.ApplyOptions) (result *configv1alpha1.CRIOCredentialProviderConfig, err error) - CRIOCredentialProviderConfigExpansion -} - -// cRIOCredentialProviderConfigs implements CRIOCredentialProviderConfigInterface -type cRIOCredentialProviderConfigs struct { - *gentype.ClientWithListAndApply[*configv1alpha1.CRIOCredentialProviderConfig, *configv1alpha1.CRIOCredentialProviderConfigList, *applyconfigurationsconfigv1alpha1.CRIOCredentialProviderConfigApplyConfiguration] -} - -// newCRIOCredentialProviderConfigs returns a CRIOCredentialProviderConfigs -func newCRIOCredentialProviderConfigs(c *ConfigV1alpha1Client) *cRIOCredentialProviderConfigs { - return &cRIOCredentialProviderConfigs{ - gentype.NewClientWithListAndApply[*configv1alpha1.CRIOCredentialProviderConfig, *configv1alpha1.CRIOCredentialProviderConfigList, *applyconfigurationsconfigv1alpha1.CRIOCredentialProviderConfigApplyConfiguration]( - "criocredentialproviderconfigs", - c.RESTClient(), - scheme.ParameterCodec, - "", - func() *configv1alpha1.CRIOCredentialProviderConfig { - return &configv1alpha1.CRIOCredentialProviderConfig{} - }, - func() *configv1alpha1.CRIOCredentialProviderConfigList { - return &configv1alpha1.CRIOCredentialProviderConfigList{} - }, - ), - } -} diff --git a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go index bc1f6031946b..666d4f061f53 100644 --- a/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go +++ b/vendor/github.com/openshift/client-go/config/clientset/versioned/typed/config/v1alpha1/generated_expansion.go @@ -4,10 +4,10 @@ package v1alpha1 type BackupExpansion interface{} -type CRIOCredentialProviderConfigExpansion interface{} - type ClusterMonitoringExpansion interface{} +type ControllerManagerExpansion interface{} + type InsightsDataGatherExpansion interface{} type PKIExpansion interface{} diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/controllermanager.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/controllermanager.go new file mode 100644 index 000000000000..6804208464f9 --- /dev/null +++ b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/controllermanager.go @@ -0,0 +1,32 @@ +// Code generated by lister-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + configv1alpha1 "github.com/openshift/api/config/v1alpha1" + labels "k8s.io/apimachinery/pkg/labels" + listers "k8s.io/client-go/listers" + cache "k8s.io/client-go/tools/cache" +) + +// ControllerManagerLister helps list ControllerManagers. +// All objects returned here must be treated as read-only. +type ControllerManagerLister interface { + // List lists all ControllerManagers in the indexer. + // Objects returned here must be treated as read-only. + List(selector labels.Selector) (ret []*configv1alpha1.ControllerManager, err error) + // Get retrieves the ControllerManager from the index for a given name. + // Objects returned here must be treated as read-only. + Get(name string) (*configv1alpha1.ControllerManager, error) + ControllerManagerListerExpansion +} + +// controllerManagerLister implements the ControllerManagerLister interface. +type controllerManagerLister struct { + listers.ResourceIndexer[*configv1alpha1.ControllerManager] +} + +// NewControllerManagerLister returns a new ControllerManagerLister. +func NewControllerManagerLister(indexer cache.Indexer) ControllerManagerLister { + return &controllerManagerLister{listers.New[*configv1alpha1.ControllerManager](indexer, configv1alpha1.Resource("controllermanager"))} +} diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/criocredentialproviderconfig.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/criocredentialproviderconfig.go deleted file mode 100644 index cc5dfa388586..000000000000 --- a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/criocredentialproviderconfig.go +++ /dev/null @@ -1,32 +0,0 @@ -// Code generated by lister-gen. DO NOT EDIT. - -package v1alpha1 - -import ( - configv1alpha1 "github.com/openshift/api/config/v1alpha1" - labels "k8s.io/apimachinery/pkg/labels" - listers "k8s.io/client-go/listers" - cache "k8s.io/client-go/tools/cache" -) - -// CRIOCredentialProviderConfigLister helps list CRIOCredentialProviderConfigs. -// All objects returned here must be treated as read-only. -type CRIOCredentialProviderConfigLister interface { - // List lists all CRIOCredentialProviderConfigs in the indexer. - // Objects returned here must be treated as read-only. - List(selector labels.Selector) (ret []*configv1alpha1.CRIOCredentialProviderConfig, err error) - // Get retrieves the CRIOCredentialProviderConfig from the index for a given name. - // Objects returned here must be treated as read-only. - Get(name string) (*configv1alpha1.CRIOCredentialProviderConfig, error) - CRIOCredentialProviderConfigListerExpansion -} - -// cRIOCredentialProviderConfigLister implements the CRIOCredentialProviderConfigLister interface. -type cRIOCredentialProviderConfigLister struct { - listers.ResourceIndexer[*configv1alpha1.CRIOCredentialProviderConfig] -} - -// NewCRIOCredentialProviderConfigLister returns a new CRIOCredentialProviderConfigLister. -func NewCRIOCredentialProviderConfigLister(indexer cache.Indexer) CRIOCredentialProviderConfigLister { - return &cRIOCredentialProviderConfigLister{listers.New[*configv1alpha1.CRIOCredentialProviderConfig](indexer, configv1alpha1.Resource("criocredentialproviderconfig"))} -} diff --git a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go index 3baf74bc8b71..240fb4f91e93 100644 --- a/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go +++ b/vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go @@ -6,14 +6,14 @@ package v1alpha1 // BackupLister. type BackupListerExpansion interface{} -// CRIOCredentialProviderConfigListerExpansion allows custom methods to be added to -// CRIOCredentialProviderConfigLister. -type CRIOCredentialProviderConfigListerExpansion interface{} - // ClusterMonitoringListerExpansion allows custom methods to be added to // ClusterMonitoringLister. type ClusterMonitoringListerExpansion interface{} +// ControllerManagerListerExpansion allows custom methods to be added to +// ControllerManagerLister. +type ControllerManagerListerExpansion interface{} + // InsightsDataGatherListerExpansion allows custom methods to be added to // InsightsDataGatherLister. type InsightsDataGatherListerExpansion interface{} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go index fe01a8995395..8a0ff7eaec20 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/internal/internal.go @@ -943,6 +943,31 @@ var schemaYAML = typed.YAMLObject(`types: type: namedType: com.github.openshift.api.operator.v1.ConsoleStatus default: {} +- name: com.github.openshift.api.operator.v1.ConsoleAuthProxyConfig + map: + fields: + - name: httpProxy + type: + scalar: string + - name: httpsProxy + type: + scalar: string + - name: noProxy + type: + list: + elementType: + scalar: string + elementRelationship: associative + - name: trustedCA + type: + namedType: com.github.openshift.api.operator.v1.ConsoleAuthProxyTrustedCAConfigMapReference + default: {} +- name: com.github.openshift.api.operator.v1.ConsoleAuthProxyTrustedCAConfigMapReference + map: + fields: + - name: name + type: + scalar: string - name: com.github.openshift.api.operator.v1.ConsoleConfigRoute map: fields: @@ -1010,6 +1035,17 @@ var schemaYAML = typed.YAMLObject(`types: type: namedType: com.github.openshift.api.operator.v1.QuickStarts default: {} +- name: com.github.openshift.api.operator.v1.ConsoleIngress + map: + fields: + - name: clientDownloadsURL + type: + scalar: string + default: "" + - name: consoleURL + type: + scalar: string + default: "" - name: com.github.openshift.api.operator.v1.ConsoleProviders map: fields: @@ -1019,13 +1055,17 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.openshift.api.operator.v1.ConsoleSpec map: fields: + - name: authProxy + type: + namedType: com.github.openshift.api.operator.v1.ConsoleAuthProxyConfig + default: {} - name: customization type: namedType: com.github.openshift.api.operator.v1.ConsoleCustomization default: {} - name: ingress type: - namedType: com.github.openshift.api.operator.v1.Ingress + namedType: com.github.openshift.api.operator.v1.ConsoleIngress default: {} - name: logLevel type: @@ -1542,6 +1582,12 @@ var schemaYAML = typed.YAMLObject(`types: - name: clientAccess type: scalar: string +- name: com.github.openshift.api.operator.v1.GatewayAPIIngressConfig + map: + fields: + - name: managementMode + type: + scalar: string - name: com.github.openshift.api.operator.v1.GatewayConfig map: fields: @@ -1760,14 +1806,24 @@ var schemaYAML = typed.YAMLObject(`types: - name: com.github.openshift.api.operator.v1.Ingress map: fields: - - name: clientDownloadsURL + - name: apiVersion type: scalar: string - default: "" - - name: consoleURL + - name: kind type: scalar: string - default: "" + - name: metadata + type: + namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta + default: {} + - name: spec + type: + namedType: com.github.openshift.api.operator.v1.IngressSpec + default: {} + - name: status + type: + namedType: com.github.openshift.api.operator.v1.IngressStatus + default: {} - name: com.github.openshift.api.operator.v1.IngressController map: fields: @@ -2086,6 +2142,27 @@ var schemaYAML = typed.YAMLObject(`types: - name: tunnelTimeout type: namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Duration +- name: com.github.openshift.api.operator.v1.IngressSpec + map: + fields: + - name: gatewayAPI + type: + namedType: com.github.openshift.api.operator.v1.GatewayAPIIngressConfig + default: {} +- name: com.github.openshift.api.operator.v1.IngressStatus + map: + fields: + - name: conditions + type: + list: + elementType: + namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition + elementRelationship: associative + keys: + - type + - name: observedGeneration + type: + scalar: numeric - name: com.github.openshift.api.operator.v1.InsightsOperator map: fields: diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxyconfig.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxyconfig.go new file mode 100644 index 000000000000..aee313f1635e --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxyconfig.go @@ -0,0 +1,78 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +// ConsoleAuthProxyConfigApplyConfiguration represents a declarative configuration of the ConsoleAuthProxyConfig type for use +// with apply. +// +// ConsoleAuthProxyConfig holds proxy configuration scoped to Console's OIDC login clients. +// At least one of httpProxy or httpsProxy must be specified. +type ConsoleAuthProxyConfigApplyConfiguration struct { + // httpProxy is the URL of the proxy for HTTP requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + HTTPProxy *string `json:"httpProxy,omitempty"` + // httpsProxy is the URL of the proxy for HTTPS requests. + // Must be a valid URL with http or https scheme, a non-empty + // hostname, and no path, query parameters, or fragment. + // Userinfo (e.g. user:password@host) is allowed for proxy + // authentication. Maximum length is 2048 characters. + HTTPSProxy *string `json:"httpsProxy,omitempty"` + // noProxy is a list of hostnames and/or CIDRs and/or IPs for which + // the proxy should not be used. Must contain at least one entry + // when set. Each entry must be between 1 and 253 characters long + // and at most 64 entries are allowed. Duplicate + // entries are not permitted. Entries that are not valid hostnames, + // CIDRs, or IPs are silently ignored. Cluster-internal defaults + // (.cluster.local, .svc, 127.0.0.1, localhost) are always appended + // automatically and do not need to be included. + NoProxy []string `json:"noProxy,omitempty"` + // trustedCA is a reference to a ConfigMap in the openshift-config + // namespace containing a CA certificate bundle under the key + // "ca-bundle.crt". This bundle is appended to the system trust store + // used by Console's OIDC login clients for proxy TLS connections. + // When omitted, only the system trust store is used. + TrustedCA *ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration `json:"trustedCA,omitempty"` +} + +// ConsoleAuthProxyConfigApplyConfiguration constructs a declarative configuration of the ConsoleAuthProxyConfig type for use with +// apply. +func ConsoleAuthProxyConfig() *ConsoleAuthProxyConfigApplyConfiguration { + return &ConsoleAuthProxyConfigApplyConfiguration{} +} + +// WithHTTPProxy sets the HTTPProxy field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the HTTPProxy field is set to the value of the last call. +func (b *ConsoleAuthProxyConfigApplyConfiguration) WithHTTPProxy(value string) *ConsoleAuthProxyConfigApplyConfiguration { + b.HTTPProxy = &value + return b +} + +// WithHTTPSProxy sets the HTTPSProxy field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the HTTPSProxy field is set to the value of the last call. +func (b *ConsoleAuthProxyConfigApplyConfiguration) WithHTTPSProxy(value string) *ConsoleAuthProxyConfigApplyConfiguration { + b.HTTPSProxy = &value + return b +} + +// WithNoProxy adds the given value to the NoProxy field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the NoProxy field. +func (b *ConsoleAuthProxyConfigApplyConfiguration) WithNoProxy(values ...string) *ConsoleAuthProxyConfigApplyConfiguration { + for i := range values { + b.NoProxy = append(b.NoProxy, values[i]) + } + return b +} + +// WithTrustedCA sets the TrustedCA field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the TrustedCA field is set to the value of the last call. +func (b *ConsoleAuthProxyConfigApplyConfiguration) WithTrustedCA(value *ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration) *ConsoleAuthProxyConfigApplyConfiguration { + b.TrustedCA = value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxytrustedcaconfigmapreference.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxytrustedcaconfigmapreference.go new file mode 100644 index 000000000000..e4be400d3a6b --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleauthproxytrustedcaconfigmapreference.go @@ -0,0 +1,30 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +// ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration represents a declarative configuration of the ConsoleAuthProxyTrustedCAConfigMapReference type for use +// with apply. +// +// ConsoleAuthProxyTrustedCAConfigMapReference references a ConfigMap in the +// openshift-config namespace. +type ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration struct { + // name is the metadata.name of the referenced ConfigMap. + // Must be a valid DNS subdomain name (RFC 1123): at most 253 + // characters, only lowercase alphanumeric characters, '-' or + // '.', starting and ending with an alphanumeric character. + Name *string `json:"name,omitempty"` +} + +// ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration constructs a declarative configuration of the ConsoleAuthProxyTrustedCAConfigMapReference type for use with +// apply. +func ConsoleAuthProxyTrustedCAConfigMapReference() *ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration { + return &ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration{} +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration) WithName(value string) *ConsoleAuthProxyTrustedCAConfigMapReferenceApplyConfiguration { + b.Name = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleingress.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleingress.go new file mode 100644 index 000000000000..3bb1ebedf979 --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consoleingress.go @@ -0,0 +1,49 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +// ConsoleIngressApplyConfiguration represents a declarative configuration of the ConsoleIngress type for use +// with apply. +// +// Ingress allows cluster admin to configure alternative ingress for the console. +type ConsoleIngressApplyConfiguration struct { + // consoleURL is a URL to be used as the base console address. + // If not specified, the console route hostname will be used. + // This field is required for clusters without ingress capability, + // where access to routes is not possible. + // Make sure that appropriate ingress is set up at this URL. + // The console operator will monitor the URL and may go degraded + // if it's unreachable for an extended period. + // Must use the HTTPS scheme. + ConsoleURL *string `json:"consoleURL,omitempty"` + // clientDownloadsURL is a URL to be used as the address to download client binaries. + // If not specified, the downloads route hostname will be used. + // This field is required for clusters without ingress capability, + // where access to routes is not possible. + // The console operator will monitor the URL and may go degraded + // if it's unreachable for an extended period. + // Must use the HTTPS scheme. + ClientDownloadsURL *string `json:"clientDownloadsURL,omitempty"` +} + +// ConsoleIngressApplyConfiguration constructs a declarative configuration of the ConsoleIngress type for use with +// apply. +func ConsoleIngress() *ConsoleIngressApplyConfiguration { + return &ConsoleIngressApplyConfiguration{} +} + +// WithConsoleURL sets the ConsoleURL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ConsoleURL field is set to the value of the last call. +func (b *ConsoleIngressApplyConfiguration) WithConsoleURL(value string) *ConsoleIngressApplyConfiguration { + b.ConsoleURL = &value + return b +} + +// WithClientDownloadsURL sets the ClientDownloadsURL field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ClientDownloadsURL field is set to the value of the last call. +func (b *ConsoleIngressApplyConfiguration) WithClientDownloadsURL(value string) *ConsoleIngressApplyConfiguration { + b.ClientDownloadsURL = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consolespec.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consolespec.go index 104941e94a18..a6b38d6bf587 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consolespec.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/consolespec.go @@ -13,6 +13,15 @@ import ( // ConsoleSpec is the specification of the desired behavior of the Console. type ConsoleSpecApplyConfiguration struct { OperatorSpecApplyConfiguration `json:""` + // authProxy configures proxy settings for outbound connections made by + // Console's OIDC login clients, including discovery, JWKS retrieval, + // code exchange, and token refresh. When set, it replaces the cluster-wide + // proxy (proxy.config.openshift.io/cluster) entirely for these connections; + // individual fields are not inherited from the cluster-wide configuration. + // At least one of httpProxy or httpsProxy must be specified. + // When omitted, the cluster-wide proxy is used if configured; otherwise no + // proxy is used. Other Console clients retain their existing proxy settings. + AuthProxy *ConsoleAuthProxyConfigApplyConfiguration `json:"authProxy,omitempty"` // customization is used to optionally provide a small set of // customization options to the web console. Customization *ConsoleCustomizationApplyConfiguration `json:"customization,omitempty"` @@ -34,7 +43,7 @@ type ConsoleSpecApplyConfiguration struct { // ingress allows to configure the alternative ingress for the console. // This field is intended for clusters without ingress capability, // where access to routes is not possible. - Ingress *IngressApplyConfiguration `json:"ingress,omitempty"` + Ingress *ConsoleIngressApplyConfiguration `json:"ingress,omitempty"` } // ConsoleSpecApplyConfiguration constructs a declarative configuration of the ConsoleSpec type for use with @@ -83,6 +92,14 @@ func (b *ConsoleSpecApplyConfiguration) WithObservedConfig(value runtime.RawExte return b } +// WithAuthProxy sets the AuthProxy field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the AuthProxy field is set to the value of the last call. +func (b *ConsoleSpecApplyConfiguration) WithAuthProxy(value *ConsoleAuthProxyConfigApplyConfiguration) *ConsoleSpecApplyConfiguration { + b.AuthProxy = value + return b +} + // WithCustomization sets the Customization field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Customization field is set to the value of the last call. @@ -120,7 +137,7 @@ func (b *ConsoleSpecApplyConfiguration) WithPlugins(values ...string) *ConsoleSp // WithIngress sets the Ingress field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. // If called multiple times, the Ingress field is set to the value of the last call. -func (b *ConsoleSpecApplyConfiguration) WithIngress(value *IngressApplyConfiguration) *ConsoleSpecApplyConfiguration { +func (b *ConsoleSpecApplyConfiguration) WithIngress(value *ConsoleIngressApplyConfiguration) *ConsoleSpecApplyConfiguration { b.Ingress = value return b } diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/gatewayapiingressconfig.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/gatewayapiingressconfig.go new file mode 100644 index 000000000000..aca3b1b5b8b2 --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/gatewayapiingressconfig.go @@ -0,0 +1,46 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + operatorv1 "github.com/openshift/api/operator/v1" +) + +// GatewayAPIIngressConfigApplyConfiguration represents a declarative configuration of the GatewayAPIIngressConfig type for use +// with apply. +// +// GatewayAPIIngressConfig holds configuration for Gateway API integration in the +// Cluster Ingress Operator. +type GatewayAPIIngressConfigApplyConfiguration struct { + // managementMode specifies how the Cluster Ingress Operator manages Gateway API + // Custom Resource Definitions (CRDs), the OpenShift Gateway API implementation, + // and its Gateway API controllers. + // + // Allowed values are "Managed" and "Unmanaged". + // + // When omitted or set to "Managed", the ingress operator installs, owns, and + // upgrades the Gateway API CRDs, protects them with a Validating Admission + // Policy, and deploys the OpenShift Gateway API implementation and its Gateway + // API controllers. + // + // When set to "Unmanaged", the ingress operator does not install or manage + // Gateway API CRDs and does not deploy the OpenShift Gateway API implementation + // or its Gateway API controllers. The cluster administrator or a third-party + // product is responsible for providing their own CRDs and Gateway controller. + // The ingress operator reports observational status only. + ManagementMode *operatorv1.GatewayAPIManagementMode `json:"managementMode,omitempty"` +} + +// GatewayAPIIngressConfigApplyConfiguration constructs a declarative configuration of the GatewayAPIIngressConfig type for use with +// apply. +func GatewayAPIIngressConfig() *GatewayAPIIngressConfigApplyConfiguration { + return &GatewayAPIIngressConfigApplyConfiguration{} +} + +// WithManagementMode sets the ManagementMode field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ManagementMode field is set to the value of the last call. +func (b *GatewayAPIIngressConfigApplyConfiguration) WithManagementMode(value operatorv1.GatewayAPIManagementMode) *GatewayAPIIngressConfigApplyConfiguration { + b.ManagementMode = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingress.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingress.go index 11cb5a23772e..ed00ec968989 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingress.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingress.go @@ -2,48 +2,277 @@ package v1 +import ( + operatorv1 "github.com/openshift/api/operator/v1" + internal "github.com/openshift/client-go/operator/applyconfigurations/internal" + apismetav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + managedfields "k8s.io/apimachinery/pkg/util/managedfields" + metav1 "k8s.io/client-go/applyconfigurations/meta/v1" +) + // IngressApplyConfiguration represents a declarative configuration of the Ingress type for use // with apply. // -// Ingress allows cluster admin to configure alternative ingress for the console. +// Ingress contains configuration options specific to the Ingress Operator itself, +// including how it manages Gateway API integration. +// +// Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer). type IngressApplyConfiguration struct { - // consoleURL is a URL to be used as the base console address. - // If not specified, the console route hostname will be used. - // This field is required for clusters without ingress capability, - // where access to routes is not possible. - // Make sure that appropriate ingress is set up at this URL. - // The console operator will monitor the URL and may go degraded - // if it's unreachable for an extended period. - // Must use the HTTPS scheme. - ConsoleURL *string `json:"consoleURL,omitempty"` - // clientDownloadsURL is a URL to be used as the address to download client binaries. - // If not specified, the downloads route hostname will be used. - // This field is required for clusters without ingress capability, - // where access to routes is not possible. - // The console operator will monitor the URL and may go degraded - // if it's unreachable for an extended period. - // Must use the HTTPS scheme. - ClientDownloadsURL *string `json:"clientDownloadsURL,omitempty"` -} - -// IngressApplyConfiguration constructs a declarative configuration of the Ingress type for use with + metav1.TypeMetaApplyConfiguration `json:""` + // metadata is the standard object's metadata. + // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + *metav1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"` + // spec holds user settable values for configuration. + Spec *IngressSpecApplyConfiguration `json:"spec,omitempty"` + // status holds observed values from the cluster. + Status *IngressStatusApplyConfiguration `json:"status,omitempty"` +} + +// Ingress constructs a declarative configuration of the Ingress type for use with // apply. -func Ingress() *IngressApplyConfiguration { - return &IngressApplyConfiguration{} +func Ingress(name string) *IngressApplyConfiguration { + b := &IngressApplyConfiguration{} + b.WithName(name) + b.WithKind("Ingress") + b.WithAPIVersion("operator.openshift.io/v1") + return b +} + +// ExtractIngressFrom extracts the applied configuration owned by fieldManager from +// ingress for the specified subresource. Pass an empty string for subresource to extract +// the main resource. Common subresources include "status", "scale", etc. +// ingress must be a unmodified Ingress API object that was retrieved from the Kubernetes API. +// ExtractIngressFrom provides a way to perform a extract/modify-in-place/apply workflow. +// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously +// applied if another fieldManager has updated or force applied any of the previously applied fields. +func ExtractIngressFrom(ingress *operatorv1.Ingress, fieldManager string, subresource string) (*IngressApplyConfiguration, error) { + b := &IngressApplyConfiguration{} + err := managedfields.ExtractInto(ingress, internal.Parser().Type("com.github.openshift.api.operator.v1.Ingress"), fieldManager, b, subresource) + if err != nil { + return nil, err + } + b.WithName(ingress.Name) + + b.WithKind("Ingress") + b.WithAPIVersion("operator.openshift.io/v1") + return b, nil +} + +// ExtractIngress extracts the applied configuration owned by fieldManager from +// ingress. If no managedFields are found in ingress for fieldManager, a +// IngressApplyConfiguration is returned with only the Name, Namespace (if applicable), +// APIVersion and Kind populated. It is possible that no managed fields were found for because other +// field managers have taken ownership of all the fields previously owned by fieldManager, or because +// the fieldManager never owned fields any fields. +// ingress must be a unmodified Ingress API object that was retrieved from the Kubernetes API. +// ExtractIngress provides a way to perform a extract/modify-in-place/apply workflow. +// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously +// applied if another fieldManager has updated or force applied any of the previously applied fields. +func ExtractIngress(ingress *operatorv1.Ingress, fieldManager string) (*IngressApplyConfiguration, error) { + return ExtractIngressFrom(ingress, fieldManager, "") +} + +// ExtractIngressStatus extracts the applied configuration owned by fieldManager from +// ingress for the status subresource. +func ExtractIngressStatus(ingress *operatorv1.Ingress, fieldManager string) (*IngressApplyConfiguration, error) { + return ExtractIngressFrom(ingress, fieldManager, "status") +} + +func (b IngressApplyConfiguration) IsApplyConfiguration() {} + +// WithKind sets the Kind field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Kind field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithKind(value string) *IngressApplyConfiguration { + b.TypeMetaApplyConfiguration.Kind = &value + return b +} + +// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the APIVersion field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithAPIVersion(value string) *IngressApplyConfiguration { + b.TypeMetaApplyConfiguration.APIVersion = &value + return b +} + +// WithName sets the Name field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Name field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithName(value string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.Name = &value + return b +} + +// WithGenerateName sets the GenerateName field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the GenerateName field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithGenerateName(value string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.GenerateName = &value + return b +} + +// WithNamespace sets the Namespace field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Namespace field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithNamespace(value string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.Namespace = &value + return b +} + +// WithUID sets the UID field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the UID field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithUID(value types.UID) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.UID = &value + return b } -// WithConsoleURL sets the ConsoleURL field in the declarative configuration to the given value +// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ConsoleURL field is set to the value of the last call. -func (b *IngressApplyConfiguration) WithConsoleURL(value string) *IngressApplyConfiguration { - b.ConsoleURL = &value +// If called multiple times, the ResourceVersion field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithResourceVersion(value string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.ResourceVersion = &value return b } -// WithClientDownloadsURL sets the ClientDownloadsURL field in the declarative configuration to the given value +// WithGeneration sets the Generation field in the declarative configuration to the given value // and returns the receiver, so that objects can be built by chaining "With" function invocations. -// If called multiple times, the ClientDownloadsURL field is set to the value of the last call. -func (b *IngressApplyConfiguration) WithClientDownloadsURL(value string) *IngressApplyConfiguration { - b.ClientDownloadsURL = &value +// If called multiple times, the Generation field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithGeneration(value int64) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.Generation = &value return b } + +// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the CreationTimestamp field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithCreationTimestamp(value apismetav1.Time) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.CreationTimestamp = &value + return b +} + +// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the DeletionTimestamp field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithDeletionTimestamp(value apismetav1.Time) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value + return b +} + +// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value + return b +} + +// WithLabels puts the entries into the Labels field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the Labels field, +// overwriting an existing map entries in Labels field with the same key. +func (b *IngressApplyConfiguration) WithLabels(entries map[string]string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 { + b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.ObjectMetaApplyConfiguration.Labels[k] = v + } + return b +} + +// WithAnnotations puts the entries into the Annotations field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, the entries provided by each call will be put on the Annotations field, +// overwriting an existing map entries in Annotations field with the same key. +func (b *IngressApplyConfiguration) WithAnnotations(entries map[string]string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 { + b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries)) + } + for k, v := range entries { + b.ObjectMetaApplyConfiguration.Annotations[k] = v + } + return b +} + +// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the OwnerReferences field. +func (b *IngressApplyConfiguration) WithOwnerReferences(values ...*metav1.OwnerReferenceApplyConfiguration) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + for i := range values { + if values[i] == nil { + panic("nil value passed to WithOwnerReferences") + } + b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i]) + } + return b +} + +// WithFinalizers adds the given value to the Finalizers field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Finalizers field. +func (b *IngressApplyConfiguration) WithFinalizers(values ...string) *IngressApplyConfiguration { + b.ensureObjectMetaApplyConfigurationExists() + for i := range values { + b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i]) + } + return b +} + +func (b *IngressApplyConfiguration) ensureObjectMetaApplyConfigurationExists() { + if b.ObjectMetaApplyConfiguration == nil { + b.ObjectMetaApplyConfiguration = &metav1.ObjectMetaApplyConfiguration{} + } +} + +// WithSpec sets the Spec field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Spec field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithSpec(value *IngressSpecApplyConfiguration) *IngressApplyConfiguration { + b.Spec = value + return b +} + +// WithStatus sets the Status field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the Status field is set to the value of the last call. +func (b *IngressApplyConfiguration) WithStatus(value *IngressStatusApplyConfiguration) *IngressApplyConfiguration { + b.Status = value + return b +} + +// GetKind retrieves the value of the Kind field in the declarative configuration. +func (b *IngressApplyConfiguration) GetKind() *string { + return b.TypeMetaApplyConfiguration.Kind +} + +// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration. +func (b *IngressApplyConfiguration) GetAPIVersion() *string { + return b.TypeMetaApplyConfiguration.APIVersion +} + +// GetName retrieves the value of the Name field in the declarative configuration. +func (b *IngressApplyConfiguration) GetName() *string { + b.ensureObjectMetaApplyConfigurationExists() + return b.ObjectMetaApplyConfiguration.Name +} + +// GetNamespace retrieves the value of the Namespace field in the declarative configuration. +func (b *IngressApplyConfiguration) GetNamespace() *string { + b.ensureObjectMetaApplyConfigurationExists() + return b.ObjectMetaApplyConfiguration.Namespace +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go index a5bf11ccad08..b049ecaed636 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerspec.go @@ -288,13 +288,20 @@ type IngressControllerSpecApplyConfiguration struct { // haproxyVersion specifies the HAProxy version to use for this // IngressController. // - // OpenShift 5.1 continues with HAProxy 3.2 (same minor version introduced - // in OpenShift 5.0) and does not introduce a new HAProxy version. + // OpenShift 5.1 uses HAProxy 3.2 as its default version and supports + // HAProxy 3.4 as an explicit, non-default opt-in. // // Valid values for OpenShift 5.1: // - Unset (default): Uses HAProxy 3.2 (the default for OpenShift 5.1) // - "3.2": Uses the latest HAProxy 3.2.z available for this OpenShift // release and pins the minor version. + // - "3.4": Uses the latest HAProxy 3.4.z available for this OpenShift + // release. This is an explicit opt-in; HAProxy 3.4 is not the default. + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default when this field is + // unset, while continuing to support "3.2" as an explicit selection. + // - OpenShift 5.3 plans to retire support for selecting HAProxy 3.2. // // Note: HAProxy 2.8 support has been dropped in OpenShift 5.1. Upgrading // from OpenShift 5.0 with haproxyVersion set to "2.8" is blocked. diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go index 33ba0de78470..55aabb269127 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingresscontrollerstatus.go @@ -71,7 +71,13 @@ type IngressControllerStatusApplyConfiguration struct { // been resolved by the operator or the feature is not enabled for this cluster. // // Examples for OpenShift 5.1: - // - "3.2": Using HAProxy 3.2 + // - "3.2": Using the default HAProxy 3.2 + // - "3.4": Using the explicitly selected, non-default HAProxy 3.4 + // + // Planned lifecycle for later OpenShift releases: + // - OpenShift 5.2 plans to make HAProxy 3.4 the default while keeping + // HAProxy 3.2 selectable. + // - OpenShift 5.3 plans to retire HAProxy 3.2. EffectiveHAProxyVersion *operatorv1.HAProxyVersion `json:"effectiveHAProxyVersion,omitempty"` } diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressspec.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressspec.go new file mode 100644 index 000000000000..a24d1a62f4f1 --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressspec.go @@ -0,0 +1,28 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +// IngressSpecApplyConfiguration represents a declarative configuration of the IngressSpec type for use +// with apply. +// +// IngressSpec is the specification of the desired behavior of the Ingress Operator. +type IngressSpecApplyConfiguration struct { + // gatewayAPI holds configuration for Gateway API integration, including how the + // ingress operator manages Gateway API CRDs, the OpenShift Gateway API + // implementation, and its Gateway API controllers. + GatewayAPI *GatewayAPIIngressConfigApplyConfiguration `json:"gatewayAPI,omitempty"` +} + +// IngressSpecApplyConfiguration constructs a declarative configuration of the IngressSpec type for use with +// apply. +func IngressSpec() *IngressSpecApplyConfiguration { + return &IngressSpecApplyConfiguration{} +} + +// WithGatewayAPI sets the GatewayAPI field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the GatewayAPI field is set to the value of the last call. +func (b *IngressSpecApplyConfiguration) WithGatewayAPI(value *GatewayAPIIngressConfigApplyConfiguration) *IngressSpecApplyConfiguration { + b.GatewayAPI = value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressstatus.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressstatus.go new file mode 100644 index 000000000000..040802e4ea48 --- /dev/null +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/ingressstatus.go @@ -0,0 +1,57 @@ +// Code generated by applyconfiguration-gen. DO NOT EDIT. + +package v1 + +import ( + metav1 "k8s.io/client-go/applyconfigurations/meta/v1" +) + +// IngressStatusApplyConfiguration represents a declarative configuration of the IngressStatus type for use +// with apply. +// +// IngressStatus defines the observed status of the Ingress Operator. +type IngressStatusApplyConfiguration struct { + // conditions is a list of conditions and their status. + // + // Gateway API CRD management conditions are reported here with the "GatewayAPI" prefix: + // + // * "GatewayAPICRDsManaged" indicates whether the ingress operator is actively + // managing Gateway API CRDs. + // * "GatewayAPICRDsPresent" indicates whether Gateway API CRDs exist on the + // cluster. + // * "GatewayAPICRDsCompliant" indicates whether the installed CRDs match the + // version expected by this ingress operator release. + Conditions []metav1.ConditionApplyConfiguration `json:"conditions,omitempty"` + // observedGeneration represents the most recent generation observed by the operator and specifies the version of + // the spec field currently being synced. + // + // When omitted, the operator has not yet observed the resource. + ObservedGeneration *int64 `json:"observedGeneration,omitempty"` +} + +// IngressStatusApplyConfiguration constructs a declarative configuration of the IngressStatus type for use with +// apply. +func IngressStatus() *IngressStatusApplyConfiguration { + return &IngressStatusApplyConfiguration{} +} + +// WithConditions adds the given value to the Conditions field in the declarative configuration +// and returns the receiver, so that objects can be build by chaining "With" function invocations. +// If called multiple times, values provided by each call will be appended to the Conditions field. +func (b *IngressStatusApplyConfiguration) WithConditions(values ...*metav1.ConditionApplyConfiguration) *IngressStatusApplyConfiguration { + for i := range values { + if values[i] == nil { + panic("nil value passed to WithConditions") + } + b.Conditions = append(b.Conditions, *values[i]) + } + return b +} + +// WithObservedGeneration sets the ObservedGeneration field in the declarative configuration to the given value +// and returns the receiver, so that objects can be built by chaining "With" function invocations. +// If called multiple times, the ObservedGeneration field is set to the value of the last call. +func (b *IngressStatusApplyConfiguration) WithObservedGeneration(value int64) *IngressStatusApplyConfiguration { + b.ObservedGeneration = &value + return b +} diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go index a5c86c13a2d5..91c012bd7bb1 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspreflightresult.go @@ -24,7 +24,10 @@ type KMSPreflightResultApplyConfiguration struct { // remoteKeyID is the remote key encryption key identifier from KMS v2 // StatusResponse.key_id. This is not a cryptographic key, but a unique // representation of the remote key used to encrypt data. - // The value must be between 1 and 1024 characters. + // When omitted, no remote key identifier is available. This is expected + // when status is Failed, for example when the KMS provider could not be + // reached. When status is Succeeded, remoteKeyID is required. + // When set, the value must be between 1 and 1024 characters. RemoteKeyID *string `json:"remoteKeyID,omitempty"` } diff --git a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/machinemanagerselector.go b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/machinemanagerselector.go index 6bee0b9abd8e..e337689d2b81 100644 --- a/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/machinemanagerselector.go +++ b/vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/machinemanagerselector.go @@ -15,6 +15,8 @@ type MachineManagerSelectorApplyConfiguration struct { // Partial requires specified selector(s) and allows customisation of which resources matched by the machine manager will be updated. // Partial is not permitted for the controlplanemachinesets resource type as they are a singleton within the cluster. // None means that every resource matched by the machine manager will not be updated. + // When boot image skew enforcement is in Automatic mode, only All is permitted for the + // machinesets and machinedeployments resource types, in any API group. Mode *operatorv1.MachineManagerSelectorMode `json:"mode,omitempty"` // partial provides label selector(s) that can be used to match machine management resources. // Only permitted when mode is set to "Partial". diff --git a/vendor/modules.txt b/vendor/modules.txt index 7f93543c1b67..7517580ee377 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1046,16 +1046,19 @@ github.com/opencontainers/image-spec/specs-go/v1 ## explicit; go 1.19 github.com/opencontainers/selinux/go-selinux github.com/opencontainers/selinux/pkg/pwalkdir -# github.com/openshift/api v0.0.0-20260922100147-3a6e03c5a473 +# github.com/openshift/api v0.0.0-20261028095540-9af1f7b4730c ## explicit; go 1.26.0 github.com/openshift/api github.com/openshift/api/annotations github.com/openshift/api/apiextensions +github.com/openshift/api/apiextensions/v1 github.com/openshift/api/apiextensions/v1alpha1 github.com/openshift/api/apiserver github.com/openshift/api/apiserver/v1 github.com/openshift/api/apps github.com/openshift/api/apps/v1 +github.com/openshift/api/authentication +github.com/openshift/api/authentication/v1alpha1 github.com/openshift/api/authorization github.com/openshift/api/authorization/v1 github.com/openshift/api/build @@ -1124,7 +1127,7 @@ github.com/openshift/api/template github.com/openshift/api/template/v1 github.com/openshift/api/user github.com/openshift/api/user/v1 -# github.com/openshift/client-go v0.0.0-20261001003915-dcaad1dc7fe8 +# github.com/openshift/client-go v0.0.0-20261026141621-1f34fe8dc069 ## explicit; go 1.26.0 github.com/openshift/client-go/config/applyconfigurations/config/v1 github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1