From a4d654f930b8dba384499d28982fed713621f87d Mon Sep 17 00:00:00 2001 From: Gianluca Mardente Date: Tue, 28 Jul 2026 17:21:56 +0200 Subject: [PATCH] chore: Add lib/crds containing addon-controller CRDs The Makefile target __make crds__ updates those. Unit tests make sure when CRDs are updated those files are as well --- Makefile | 4 + lib/crd/clusterconfigurations.go | 325 ++++ lib/crd/clusterprofiles.go | 2378 +++++++++++++++++++++++++ lib/crd/clusterpromotions.go | 2871 ++++++++++++++++++++++++++++++ lib/crd/clusterreports.go | 329 ++++ lib/crd/clustersummaries.go | 2395 +++++++++++++++++++++++++ lib/crd/crd.go | 43 + lib/crd/crd_suite_test.go | 29 + lib/crd/crd_test.go | 82 + lib/crd/generator.go | 114 ++ lib/crd/profiles.go | 2378 +++++++++++++++++++++++++ 11 files changed, 10948 insertions(+) create mode 100644 lib/crd/clusterconfigurations.go create mode 100644 lib/crd/clusterprofiles.go create mode 100644 lib/crd/clusterpromotions.go create mode 100644 lib/crd/clusterreports.go create mode 100644 lib/crd/clustersummaries.go create mode 100644 lib/crd/crd.go create mode 100644 lib/crd/crd_suite_test.go create mode 100644 lib/crd/crd_test.go create mode 100644 lib/crd/generator.go create mode 100644 lib/crd/profiles.go diff --git a/Makefile b/Makefile index 58d8191b..1a263a79 100644 --- a/Makefile +++ b/Makefile @@ -172,6 +172,10 @@ generate: $(CONTROLLER_GEN) ## Generate code containing DeepCopy, DeepCopyInto, go generate $(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..." +.PHONY: crds +crds: manifests ## Generates go code (crds) for lib/crd, embedding config/crd/bases as Go source. + cd lib/crd; go generate + .PHONY: fmt fmt: $(GOIMPORTS) ## Run go fmt against code. $(GOIMPORTS) -local github.com/projectsveltos -w . diff --git a/lib/crd/clusterconfigurations.go b/lib/crd/clusterconfigurations.go new file mode 100644 index 00000000..fd510122 --- /dev/null +++ b/lib/crd/clusterconfigurations.go @@ -0,0 +1,325 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ClusterConfigurationFile = "../../config/crd/bases/config.projectsveltos.io_clusterconfigurations.yaml" +var ClusterConfigurationCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: clusterconfigurations.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: ClusterConfiguration + listKind: ClusterConfigurationList + plural: clusterconfigurations + singular: clusterconfiguration + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterConfiguration is the Schema for the clusterconfigurations + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + status: + description: ClusterConfigurationStatus defines the observed state of + ClusterConfiguration + properties: + clusterProfileResources: + description: |- + ClusterProfileResources is the list of resources currently deployed in a Cluster due + to ClusterProfiles + items: + description: |- + ClusterProfileResource keeps info on all of the resources deployed in this Cluster + due to a given ClusterProfile + properties: + Features: + description: |- + Features contains the list of policies deployed in the Cluster because + of a given feature + items: + properties: + charts: + description: Charts is a list of helm charts deployed + in the Cluster. + items: + properties: + appVersion: + description: AppVersion is the version of the app + deployed in the Cluster. + type: string + chartVersion: + description: ChartVersion is the version of the + helm chart deployed in the Cluster. + type: string + icon: + description: The URL to an icon file. + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this + resource was last applied to the cluster. + format: date-time + type: string + namespace: + description: Namespace where chart is deployed in + the Cluster. + type: string + releaseName: + description: ReleaseName name of the release deployed + in the Cluster. + minLength: 1 + type: string + repoURL: + description: |- + RepoURL URL of the repo containing the helm chart deployed + in the Cluster. + minLength: 1 + type: string + required: + - chartVersion + - lastAppliedTime + - releaseName + - repoURL + type: object + type: array + featureID: + description: FeatureID is an indentifier of the feature + whose status is reported + enum: + - Resources + - Helm + - Kustomize + type: string + resources: + description: Resources is a list of resources deployed + in the Cluster. + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources is deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + group: + description: Group of the resource deployed in the + Cluster. + type: string + kind: + description: Kind of the resource deployed in the + Cluster. + minLength: 1 + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this + resource was last applied to the cluster. + format: date-time + type: string + name: + description: Name of the resource deployed in the + Cluster. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the resource deployed in the Cluster. + Empty for resources scoped at cluster level. + type: string + version: + description: Version of the resource deployed in + the Cluster. + minLength: 1 + type: string + required: + - group + - kind + - name + - version + type: object + type: array + required: + - featureID + type: object + type: array + clusterProfileName: + description: ProfileName is the name of the ClusterProfile matching + the Cluster. + type: string + required: + - clusterProfileName + type: object + type: array + profileResources: + description: |- + ProfileResources is the list of resources currently deployed in a Cluster due + to Profiles + items: + description: |- + ProfileResource keeps info on all of the resources deployed in this Cluster + due to a given Profile + properties: + Features: + description: |- + Features contains the list of policies deployed in the Cluster because + of a given feature + items: + properties: + charts: + description: Charts is a list of helm charts deployed + in the Cluster. + items: + properties: + appVersion: + description: AppVersion is the version of the app + deployed in the Cluster. + type: string + chartVersion: + description: ChartVersion is the version of the + helm chart deployed in the Cluster. + type: string + icon: + description: The URL to an icon file. + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this + resource was last applied to the cluster. + format: date-time + type: string + namespace: + description: Namespace where chart is deployed in + the Cluster. + type: string + releaseName: + description: ReleaseName name of the release deployed + in the Cluster. + minLength: 1 + type: string + repoURL: + description: |- + RepoURL URL of the repo containing the helm chart deployed + in the Cluster. + minLength: 1 + type: string + required: + - chartVersion + - lastAppliedTime + - releaseName + - repoURL + type: object + type: array + featureID: + description: FeatureID is an indentifier of the feature + whose status is reported + enum: + - Resources + - Helm + - Kustomize + type: string + resources: + description: Resources is a list of resources deployed + in the Cluster. + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources is deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + group: + description: Group of the resource deployed in the + Cluster. + type: string + kind: + description: Kind of the resource deployed in the + Cluster. + minLength: 1 + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this + resource was last applied to the cluster. + format: date-time + type: string + name: + description: Name of the resource deployed in the + Cluster. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the resource deployed in the Cluster. + Empty for resources scoped at cluster level. + type: string + version: + description: Version of the resource deployed in + the Cluster. + minLength: 1 + type: string + required: + - group + - kind + - name + - version + type: object + type: array + required: + - featureID + type: object + type: array + profileName: + description: ProfileName is the name of the Profile matching + the Cluster. + type: string + required: + - profileName + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +`) diff --git a/lib/crd/clusterprofiles.go b/lib/crd/clusterprofiles.go new file mode 100644 index 00000000..8808ae44 --- /dev/null +++ b/lib/crd/clusterprofiles.go @@ -0,0 +1,2378 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ClusterProfileFile = "../../config/crd/bases/config.projectsveltos.io_clusterprofiles.yaml" +var ClusterProfileCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: clusterprofiles.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: ClusterProfile + listKind: ClusterProfileList + plural: clusterprofiles + singular: clusterprofile + scope: Cluster + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterProfile is the Schema for the clusterprofiles API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + clusterRefs: + description: ClusterRefs identifies clusters to associate to. + items: + description: ObjectReference contains enough information to let + you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + clusterSelector: + description: ClusterSelector identifies clusters to associate to. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + continueOnConflict: + default: false + description: |- + By default (when ContinueOnConflict is unset or set to false), Sveltos stops deployment after + encountering the first conflict (e.g., another ClusterProfile already deployed the resource). + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if conflicts are detected for previous resources. + type: boolean + continueOnError: + default: false + description: |- + By default (when ContinueOnError is unset or set to false), Sveltos stops deployment after + encountering the first error. + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if errors are detected for previous resources. + type: boolean + dependsOn: + description: |- + DependsOn specifies a list of other profiles that this instance depends on. + A ClusterProfile can only depend on other ClusterProfiles, and a Profile can + only depend on other Profiles. + The add-ons and applications defined in this instance will not be deployed + until all add-ons and applications in the profiles listed as dependencies are deployed. + items: + type: string + type: array + driftExclusions: + description: |- + DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is + set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore + when evaluating drift, optionally targeting specific resources and features. + items: + properties: + paths: + description: Paths is a slice of JSON6902 paths to exclude from + configuration drift evaluation. + items: + type: string + type: array + target: + description: Target points to the resources that the paths refers + to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + x-kubernetes-list-type: atomic + extraAnnotations: + additionalProperties: + type: string + description: |- + ExtraAnnotations: These annotations will be added by Sveltos to all Kubernetes resources + deployed in a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a annotation with a key present in + ` + "`" + `ExtraAnnotations` + "`" + `, the value from ` + "`" + `ExtraAnnotations` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + extraLabels: + additionalProperties: + type: string + description: |- + ExtraLabels: These labels will be added by Sveltos to all Kubernetes resources deployed in + a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a label with a key present in + ` + "`" + `ExtraLabels` + "`" + `, the value from ` + "`" + `ExtraLabels` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + helmCharts: + description: Helm charts is a list of helm charts that need to be + deployed + items: + properties: + chartName: + description: |- + ChartName is the chart name + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + Must be defined otherwise. + type: string + chartVersion: + description: |- + ChartVersion is the chart version + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + helmChartAction: + default: Install + description: HelmChartAction is the action that will be taken + on the helm chart + enum: + - Install + - Uninstall + type: string + options: + description: Options allows to set flags which are used during + installation. + properties: + atomic: + default: false + description: |- + if set, the installation process deletes the installation/upgrades on failure. + The --wait flag will be set automatically if --atomic is used + Default to false + type: boolean + dependencyUpdate: + default: false + description: |- + update dependencies if they are missing before installing the chart + Default to false + type: boolean + description: + description: Description is the description of an helm operation + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install/upgrade/uninstall + Default to false + type: boolean + disableOpenAPIValidation: + default: false + description: |- + if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema + Default to false + type: boolean + enableClientCache: + default: false + description: EnableClientCache is a flag to enable Helm + client cache. If it is not specified, it will be set to + false. + type: boolean + installOptions: + description: HelmInstallOptions are options specific to + helm install + properties: + createNamespace: + default: true + description: Create the release namespace if not present. + Defaults to true + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on install + Default to false + type: boolean + replace: + default: true + description: Replaces if set indicates to replace an + older release with this one + type: boolean + takeOwnership: + default: false + description: |- + if set, install will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Labels that would be added to release metadata. + type: object + passCredentialsAll: + description: PassCredentialsAll is the flag to pass credentials + to all domains + type: boolean + postRenderStrategy: + description: |- + PostRenderStrategy controls whether Helm hooks are included when Patches/PatchesFrom + are applied as a post-renderer during this chart's install/upgrade. Only relevant + when Patches or PatchesFrom is set on the Spec; ignored otherwise. Defaults to + Helm's own default (combined) when unset. + enum: + - combined + - separate + - nohooks + type: string + runTests: + default: false + description: |- + RunTests if set to true, Sveltos will run helm test after each successful install or upgrade + operation. The tests are the test hooks defined in the chart (annotated with + "helm.sh/hook: test"). If any test fails the deployment is considered failed and the + error is surfaced in the ClusterSummary status, providing operational gating. + Has no effect in DryRun mode. + Default to false + type: boolean + skipCRDs: + default: false + description: |- + SkipCRDs controls whether CRDs should be installed during install/upgrade operation. + By default, CRDs are installed if not already present. + type: boolean + skipSchemaValidation: + default: false + description: SkipSchemaValidation determines if JSON schema + validation is disabled. + type: boolean + timeout: + description: time to wait for any individual Kubernetes + operation (like Jobs for hooks) (default 5m0s) + type: string + uninstallOptions: + description: HelmUninstallOptions are options specific to + helm uninstall + properties: + deletionPropagation: + description: DeletionPropagation + enum: + - orphan + - foreground + - background + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on uninstall + Default to false + type: boolean + keepHistory: + description: |- + When uninstall a chart with this flag, Helm removes the resources associated with the chart, + but it keeps the release information. This allows to see details about the uninstalled release + using the helm history command. + type: boolean + type: object + upgradeOptions: + description: HelmUpgradeOptions are options specific to + helm upgrade + properties: + cleanupOnFail: + default: false + description: CleanupOnFail will, if true, cause the + upgrade to delete newly-created resources on a failed + update. + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on upgrade + Default to false + type: boolean + force: + default: false + description: |- + Force will, if set to ` + "`" + `true` + "`" + `, ignore certain warnings and perform the upgrade anyway. + This should be used with caution. + type: boolean + maxHistory: + default: 2 + description: |- + MaxHistory limits the maximum number of revisions saved per release + Default to 2 + type: integer + recreate: + default: false + description: |- + Recreate will (if true) recreate pods after a rollback. + + Deprecated: This field is no longer supported + type: boolean + resetThenReuseValues: + default: false + description: ResetThenReuseValues will reset the values + to the chart's built-ins then merge with user's last + supplied values. + type: boolean + resetValues: + default: false + description: ResetValues will reset the values to the + chart's built-ins rather than merging with existing. + type: boolean + reuseValues: + default: false + description: |- + ReuseValues copies values from the current release to a new release if the + new release does not have any values. If the request already has values, + or if there are no values in the current release, this does nothing. + This is skipped if the ResetValues flag is set, in which case the + request values are not altered. + type: boolean + subNotes: + default: false + description: SubNotes determines whether sub-notes are + rendered in the chart. + type: boolean + takeOwnership: + default: false + description: |- + if set, upgrade will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + upgradeCRDs: + default: false + description: |- + UpgradeCRDs upgrade CRDs from the Helm Chart's crds directory + By default, CRDs are not applied during Helm upgrade action by Helm + https://helm.sh/docs/chart_best_practices/custom_resource_definitions/ + type: boolean + type: object + wait: + default: false + description: |- + if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet + are in a ready state before marking the release as successful. It will wait for as long as --timeout + Default to false + type: boolean + waitForJobs: + default: false + description: |- + if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. + It will wait for as long as --timeout + Default to false + type: boolean + type: object + provenanceVerification: + description: |- + ProvenanceVerification configures Helm GPG .prov file verification for HTTP chart repositories. + Ignored for OCI and Flux-sourced charts. + properties: + keyringSecretRef: + description: |- + KeyringSecretRef references a Secret in the management cluster containing the GPG keyring. + The Secret must have a key named "keyring.gpg". + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - keyringSecretRef + type: object + registryCredentialsConfig: + description: |- + RegistryCredentialsConfig is an optional configuration for credentials, + including information to connect to private registries. + properties: + ca: + description: |- + CASecretRef references a secret containing the TLS CA certificate + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + key: ca.crt + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + credentials: + description: |- + CredentialsSecretRef references a secret containing credentials + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + insecureSkipTLSVerify: + description: InsecureSkipTLSVerify controls server certificate + verification. + type: boolean + key: + description: |- + Key specifies the key within the CredentialsSecretRef containing the data + If not specified, it defaults to the only key in the secret if there's just one. + type: string + plainHTTP: + description: PlainHTTP indicates to use insecure HTTP connections + for the chart download + type: boolean + type: object + releaseName: + description: ReleaseName is the chart release + minLength: 1 + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace release will + be installed + minLength: 1 + type: string + repositoryName: + description: |- + RepositoryName is the name helm chart repository + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + repositoryURL: + description: |- + RepositoryURL is the URL helm chart repository + It can point to a traditional HTTP-based repository or an OCI registry. + Examples: + - HTTP Repository: https://charts.example.com/stable + - OCI Registry: oci://registry.example.com/namespace/charts + - GitHub Pages: https://.github.io// + - Any other valid URL where Helm charts are hosted. + + Alternatively, it can be a Flux source reference: + ://// + + Where: + - is the type of Flux source (gitrepository, ocirepository, bucket). + - and are the namespace and name of the Flux Source in the management cluster. + - is the path within the source repository where the Helm charts are located. + + For instance: + gitrepository://flux-system/flux-system/charts/projectsveltos + + Assuming there is a Flux GitRepository named 'flux-system' in the 'flux-system' namespace + syncing 'https://github.com/projectsveltos/helm-charts.git/', and the Helm charts are + located in the 'charts/projectsveltos' directory of that repository. + minLength: 1 + type: string + signatureVerification: + description: |- + SignatureVerification configures Cosign-based signature verification for OCI Helm charts. + Ignored when RepositoryURL does not start with "oci://". + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity lists OIDC identity matchers for keyless verification. + At least one matcher must be satisfied. Required when Provider is Keyless. + items: + description: OIDCIdentityMatcher specifies the expected + OIDC issuer and subject for keyless Cosign verification. + properties: + issuer: + description: Issuer is the OIDC issuer URL or regex. + minLength: 1 + type: string + subject: + description: Subject is the OIDC subject or regex, + typically the workload identity or GitHub Actions + workflow URL. + minLength: 1 + type: string + required: + - issuer + - subject + type: object + type: array + provider: + description: Provider specifies how to obtain the verification + key or certificate. + enum: + - PublicKey + - Keyless + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing the Cosign public key. + The Secret must have a key named "cosign.pub" holding a PEM-encoded public key. + Required when Provider is PublicKey. + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - provider + type: object + values: + description: |- + Values field allows to define configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + required: + - releaseName + - releaseNamespace + - repositoryURL + type: object + x-kubernetes-validations: + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartName) + >= 1 : true' + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartName) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartVersion) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartVersion) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.repositoryName) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.repositoryName) + >= 1 : true' + type: array + x-kubernetes-list-type: atomic + kustomizationRefs: + description: |- + Kustomization refs is a list of kustomization paths. Kustomization will + be run on those paths and the outcome will be deployed. + items: + properties: + components: + description: |- + Components is a list of paths to Kustomize components. These paths are relative to the + ` + "`" + `Path` + "`" + ` field and are included in the Kustomize build to provide reusable configuration logic. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + type: string + type: array + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + NOTE: DeploymentType Local cannot be used when the matching cluster is the management cluster itself. + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + KustomizationRef when an update is rejected with an error that only a delete+recreate + can resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - flux GitRepository;OCIRepository;Bucket + - ConfigMap/Secret + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS + endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket + or a ConfigMap/Secret. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the remote source serving the Kustomize directory content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball + (.tar.gz) of the Kustomize directory + "oci://" — OCI registry artifact whose layers are extracted + the same way, preserving the directory tree + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this KustomizationRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different KustomizationRef + within the same ClusterProfile or Profile. + When two KustomizationRef attempt to deploy the same resource, the KustomizationRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + values: + additionalProperties: + type: string + description: |- + Values is a map[string]string type that allows to define a set of key-value pairs. + These key-value pairs can optionally leverage Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + type: object + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to define key-value pairs. These key-value pairs can optionally leverage + Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + maxConsecutiveFailures: + description: |- + The maximum number of consecutive deployment failures that Sveltos will permit. + After this many consecutive failures, the deployment will be considered failed, and Sveltos will stop retrying. + This setting applies only to feature deployments, not resource removal. + This field is optional. If not set, Sveltos default behavior is to keep retrying. + type: integer + maxUpdate: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of clusters that can be updated concurrently. + Value can be an absolute number (ex: 5) or a percentage of desired cluster (ex: 10%). + Defaults to 100%. + Example: when this is set to 30%, when list of add-ons/applications in ClusterProfile + changes, only 30% of matching clusters will be updated in parallel. Only when updates + in those cluster succeed, other matching clusters are updated. + pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ + x-kubernetes-int-or-string: true + patches: + description: |- + Define additional Kustomize inline Patches applied for all resources on this profile + Within the Patch Spec you can use templating + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + x-kubernetes-list-type: atomic + patchesFrom: + description: |- + PatchesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store additional Kustomize inline Patches applied for all resources on this profile + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + x-kubernetes-list-type: atomic + policyRefs: + description: |- + PolicyRefs references all the ConfigMaps/Secrets/Flux Sources containing kubernetes resources + that need to be deployed in the matching managed clusters. + The values contained in those resources can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + postDeleteChecks: + description: |- + PostDeleteChecks is a slice of checks to run against the managed cluster + *after* Sveltos has deleted all resources. + This ensures that the environment has reached the desired clean state. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeleteChecks: + description: |- + PreDeleteChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deleting resources. + If any of these fail, the deletion process is halted. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeployChecks: + description: |- + PreDeployChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deploying resources. + Each check can use Lua scripts or CEL expressions to validate the cluster state. + If any check fails, the deployment of the associated feature is halted. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + reloader: + default: false + description: |- + Reloader indicates whether Deployment/StatefulSet/DaemonSet instances deployed + by Sveltos and part of this ClusterProfile need to be restarted via rolling upgrade + when a ConfigMap/Secret instance mounted as volume is modified. + When set to true, when any mounted ConfigMap/Secret is modified, Sveltos automatically + starts a rolling upgrade for Deployment/StatefulSet/DaemonSet instances mounting it. + type: boolean + setRefs: + description: |- + SetRefs identifies referenced (cluster)Sets. + - ClusterProfile can reference ClusterSet; + - Profile can reference Set; + items: + type: string + type: array + stopMatchingBehavior: + default: WithdrawPolicies + description: |- + StopMatchingBehavior indicates what behavior should be when a Cluster stop matching + the ClusterProfile. By default all deployed Helm charts and Kubernetes resources will + be withdrawn from Cluster. Setting StopMatchingBehavior to LeavePolicies will instead + leave ClusterProfile deployed policies in the Cluster. + enum: + - WithdrawPolicies + - LeavePolicies + type: string + syncMode: + default: Continuous + description: |- + SyncMode specifies how features are synced in a matching workload cluster. + - OneTime means, first time a workload cluster matches the ClusterProfile, + features will be deployed in such cluster. Any subsequent feature configuration + change won't be applied into the matching workload clusters; + - Continuous mode ensures that the first time a workload cluster matches a ClusterProfile, + the specified features are deployed. Subsequent changes to the feature configuration are also + automatically applied to all matching workload clusters. + _ SyncModeContinuousWithDriftDetection operates similarly to Continuous mode, but also monitors + matching managed clusters for configuration drift. If drift is detected, a reconciliation is + triggered to ensure the managed cluster's configuration aligns with the ClusterProfile. + - DryRun means no change will be propagated to any matching cluster. A report + instead will be generated summarizing what would happen in any matching cluster + because of the changes made to ClusterProfile while in DryRun mode. + enum: + - OneTime + - Continuous + - ContinuousWithDriftDetection + - DryRun + type: string + templateResourceRefs: + description: |- + TemplateResourceRefs is a list of resource to collect from the management cluster. + Those resources' values will be used to instantiate templates + items: + properties: + identifier: + description: |- + Identifier is how the resource will be referred to in the + template + type: string + ignoreStatusChanges: + default: false + description: |- + IgnoreStatusChanges indicates whether changes to the status of the referenced + resource should be ignored. If set to true, only changes to the spec or + metadata (generation change) will trigger a reconciliation. + type: boolean + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other TemplateResourceRefs. + type: boolean + resource: + description: |- + Resource references a Kubernetes instance in the management + cluster to fetch and use during template instantiation. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + Name and namespace can be expressed as a template and instantiate using any cluster field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + watchFields: + description: |- + WatchFields is an optional list of dot-separated field paths to include + when computing the hash for this resource (e.g. "status.readyReplicas", + "metadata.labels"). When non-empty, only the listed fields are hashed and + IgnoreStatusChanges is ignored. Use this when you need to react to a + specific field without being sensitive to every other change on the object. + items: + type: string + type: array + required: + - identifier + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - identifier + x-kubernetes-list-type: map + tier: + default: 100 + description: |- + Tier controls the order of deployment for ClusterProfile or Profile resources targeting + the same cluster resources. + Imagine two configurations (ClusterProfiles or Profiles) trying to deploy the same resource (a Kubernetes + resource or an helm chart). By default, the first one to reach the cluster "wins" and deploys it. + Tier allows you to override this. When conflicts arise, the ClusterProfile or Profile with the **lowest** + Tier value takes priority and deploys the resource. + Higher Tier values represent lower priority. The default Tier value is 100. + Using Tiers provides finer control over resource deployment within your cluster, particularly useful + when multiple configurations manage the same resources. + format: int32 + minimum: 1 + type: integer + validateHealths: + description: |- + ValidateHealths is a slice of checks to run against the managed cluster + *after* resources are deployed to validate that the state of the + add-ons/applications is healthy. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + status: + description: Status defines the observed state of ClusterProfile/Profile + properties: + dependenciesHash: + description: |- + DependenciesHash is a hash representing the set of clusters where this ClusterProfile + must be deployed, based on the combined configuration of its dependencies. + format: byte + type: string + failedClusters: + description: |- + FailedClusters contains information about clusters for which + a ClusterSummary could not be created or updated. + items: + description: |- + FailedCluster describes an error encountered while trying to + manage resources for a specific matching cluster. + properties: + clusterRef: + description: ClusterRef is a reference to the cluster where + the failure occurred. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + failureMessage: + description: |- + FailureMessage is a human-readable explanation of why the + ClusterSummary creation/update failed. + type: string + lastFailureTime: + description: LastFailureTime is the time the error occurred. + format: date-time + type: string + required: + - clusterRef + - failureMessage + type: object + type: array + matchingClusters: + description: |- + MatchingClusterRefs reference all the clusters currently matching + ClusterProfile ClusterSelector + items: + description: ObjectReference contains enough information to let + you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + reconciliationSuspended: + description: |- + ReconciliationSuspended indicates whether the reconciliation loop for this + ClusterSummary is currently paused due to an external action (e.g., a user annotation). + When true, the status will not be updated unless the pause is lifted. + type: boolean + suspensionReason: + description: SuspensionReason provides a brief explanation of why + the reconciliation is suspended. + type: string + updatedClusters: + description: |- + UpdatedClusters contains information all the cluster currently matching + ClusterProfile ClusterSelector and already updated to latest ClusterProfile + Spec + properties: + clusters: + description: |- + Clusters reference all the clusters currently matching + ClusterProfile ClusterSelector and already updated/being updated + to ClusterProfile Spec + items: + description: ObjectReference contains enough information to + let you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + hash: + description: |- + Hash represents of a unique value for ClusterProfile Spec at + a fixed point in time + format: byte + type: string + type: object + updatingClusters: + description: |- + UpdatingClusters reference all the cluster currently matching + ClusterProfile ClusterSelector and being updated + properties: + clusters: + description: |- + Clusters reference all the clusters currently matching + ClusterProfile ClusterSelector and already updated/being updated + to ClusterProfile Spec + items: + description: ObjectReference contains enough information to + let you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + hash: + description: |- + Hash represents of a unique value for ClusterProfile Spec at + a fixed point in time + format: byte + type: string + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +`) diff --git a/lib/crd/clusterpromotions.go b/lib/crd/clusterpromotions.go new file mode 100644 index 00000000..aee1b603 --- /dev/null +++ b/lib/crd/clusterpromotions.go @@ -0,0 +1,2871 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ClusterPromotionFile = "../../config/crd/bases/config.projectsveltos.io_clusterpromotions.yaml" +var ClusterPromotionCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: clusterpromotions.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: ClusterPromotion + listKind: ClusterPromotionList + plural: clusterpromotions + singular: clusterpromotion + scope: Cluster + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterPromotion is the Schema for the ClusterPromotions API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of ClusterPromotion + properties: + preserveClusterProfilesOnDelete: + description: |- + PreserveClusterProfilesOnDelete, if true, prevents the controller from deleting + the associated ClusterProfiles when this ClusterPromotion is deleted. + The ClusterProfiles will remain, and will need to be manually cleaned up. + type: boolean + profileSpec: + description: |- + ProfileSpec contains the common configuration for the Sveltos ClusterProfiles + that will be created at each stage. + properties: + continueOnConflict: + default: false + description: |- + By default (when ContinueOnConflict is unset or set to false), Sveltos stops deployment after + encountering the first conflict (e.g., another ClusterProfile already deployed the resource). + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if conflicts are detected for previous resources. + type: boolean + continueOnError: + default: false + description: |- + By default (when ContinueOnError is unset or set to false), Sveltos stops deployment after + encountering the first error. + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if errors are detected for previous resources. + type: boolean + dependsOn: + description: |- + DependsOn specifies a list of other profiles that this instance depends on. + A ClusterProfile can only depend on other ClusterProfiles, and a Profile can + only depend on other Profiles. + The add-ons and applications defined in this instance will not be deployed + until all add-ons and applications in the profiles listed as dependencies are deployed. + items: + type: string + type: array + driftExclusions: + description: |- + DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is + set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore + when evaluating drift, optionally targeting specific resources and features. + items: + properties: + paths: + description: Paths is a slice of JSON6902 paths to exclude + from configuration drift evaluation. + items: + type: string + type: array + target: + description: Target points to the resources that the paths + refers to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + x-kubernetes-list-type: atomic + helmCharts: + description: Helm charts is a list of helm charts that need to + be deployed + items: + properties: + chartName: + description: |- + ChartName is the chart name + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + Must be defined otherwise. + type: string + chartVersion: + description: |- + ChartVersion is the chart version + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + helmChartAction: + default: Install + description: HelmChartAction is the action that will be + taken on the helm chart + enum: + - Install + - Uninstall + type: string + options: + description: Options allows to set flags which are used + during installation. + properties: + atomic: + default: false + description: |- + if set, the installation process deletes the installation/upgrades on failure. + The --wait flag will be set automatically if --atomic is used + Default to false + type: boolean + dependencyUpdate: + default: false + description: |- + update dependencies if they are missing before installing the chart + Default to false + type: boolean + description: + description: Description is the description of an helm + operation + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install/upgrade/uninstall + Default to false + type: boolean + disableOpenAPIValidation: + default: false + description: |- + if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema + Default to false + type: boolean + enableClientCache: + default: false + description: EnableClientCache is a flag to enable Helm + client cache. If it is not specified, it will be set + to false. + type: boolean + installOptions: + description: HelmInstallOptions are options specific + to helm install + properties: + createNamespace: + default: true + description: Create the release namespace if not + present. Defaults to true + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on install + Default to false + type: boolean + replace: + default: true + description: Replaces if set indicates to replace + an older release with this one + type: boolean + takeOwnership: + default: false + description: |- + if set, install will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Labels that would be added to release metadata. + type: object + passCredentialsAll: + description: PassCredentialsAll is the flag to pass + credentials to all domains + type: boolean + postRenderStrategy: + description: |- + PostRenderStrategy controls whether Helm hooks are included when Patches/PatchesFrom + are applied as a post-renderer during this chart's install/upgrade. Only relevant + when Patches or PatchesFrom is set on the Spec; ignored otherwise. Defaults to + Helm's own default (combined) when unset. + enum: + - combined + - separate + - nohooks + type: string + runTests: + default: false + description: |- + RunTests if set to true, Sveltos will run helm test after each successful install or upgrade + operation. The tests are the test hooks defined in the chart (annotated with + "helm.sh/hook: test"). If any test fails the deployment is considered failed and the + error is surfaced in the ClusterSummary status, providing operational gating. + Has no effect in DryRun mode. + Default to false + type: boolean + skipCRDs: + default: false + description: |- + SkipCRDs controls whether CRDs should be installed during install/upgrade operation. + By default, CRDs are installed if not already present. + type: boolean + skipSchemaValidation: + default: false + description: SkipSchemaValidation determines if JSON + schema validation is disabled. + type: boolean + timeout: + description: time to wait for any individual Kubernetes + operation (like Jobs for hooks) (default 5m0s) + type: string + uninstallOptions: + description: HelmUninstallOptions are options specific + to helm uninstall + properties: + deletionPropagation: + description: DeletionPropagation + enum: + - orphan + - foreground + - background + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on uninstall + Default to false + type: boolean + keepHistory: + description: |- + When uninstall a chart with this flag, Helm removes the resources associated with the chart, + but it keeps the release information. This allows to see details about the uninstalled release + using the helm history command. + type: boolean + type: object + upgradeOptions: + description: HelmUpgradeOptions are options specific + to helm upgrade + properties: + cleanupOnFail: + default: false + description: CleanupOnFail will, if true, cause + the upgrade to delete newly-created resources + on a failed update. + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on upgrade + Default to false + type: boolean + force: + default: false + description: |- + Force will, if set to ` + "`" + `true` + "`" + `, ignore certain warnings and perform the upgrade anyway. + This should be used with caution. + type: boolean + maxHistory: + default: 2 + description: |- + MaxHistory limits the maximum number of revisions saved per release + Default to 2 + type: integer + recreate: + default: false + description: |- + Recreate will (if true) recreate pods after a rollback. + + Deprecated: This field is no longer supported + type: boolean + resetThenReuseValues: + default: false + description: ResetThenReuseValues will reset the + values to the chart's built-ins then merge with + user's last supplied values. + type: boolean + resetValues: + default: false + description: ResetValues will reset the values to + the chart's built-ins rather than merging with + existing. + type: boolean + reuseValues: + default: false + description: |- + ReuseValues copies values from the current release to a new release if the + new release does not have any values. If the request already has values, + or if there are no values in the current release, this does nothing. + This is skipped if the ResetValues flag is set, in which case the + request values are not altered. + type: boolean + subNotes: + default: false + description: SubNotes determines whether sub-notes + are rendered in the chart. + type: boolean + takeOwnership: + default: false + description: |- + if set, upgrade will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + upgradeCRDs: + default: false + description: |- + UpgradeCRDs upgrade CRDs from the Helm Chart's crds directory + By default, CRDs are not applied during Helm upgrade action by Helm + https://helm.sh/docs/chart_best_practices/custom_resource_definitions/ + type: boolean + type: object + wait: + default: false + description: |- + if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet + are in a ready state before marking the release as successful. It will wait for as long as --timeout + Default to false + type: boolean + waitForJobs: + default: false + description: |- + if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. + It will wait for as long as --timeout + Default to false + type: boolean + type: object + provenanceVerification: + description: |- + ProvenanceVerification configures Helm GPG .prov file verification for HTTP chart repositories. + Ignored for OCI and Flux-sourced charts. + properties: + keyringSecretRef: + description: |- + KeyringSecretRef references a Secret in the management cluster containing the GPG keyring. + The Secret must have a key named "keyring.gpg". + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - keyringSecretRef + type: object + registryCredentialsConfig: + description: |- + RegistryCredentialsConfig is an optional configuration for credentials, + including information to connect to private registries. + properties: + ca: + description: |- + CASecretRef references a secret containing the TLS CA certificate + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + key: ca.crt + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + credentials: + description: |- + CredentialsSecretRef references a secret containing credentials + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + insecureSkipTLSVerify: + description: InsecureSkipTLSVerify controls server certificate + verification. + type: boolean + key: + description: |- + Key specifies the key within the CredentialsSecretRef containing the data + If not specified, it defaults to the only key in the secret if there's just one. + type: string + plainHTTP: + description: PlainHTTP indicates to use insecure HTTP + connections for the chart download + type: boolean + type: object + releaseName: + description: ReleaseName is the chart release + minLength: 1 + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace release will + be installed + minLength: 1 + type: string + repositoryName: + description: |- + RepositoryName is the name helm chart repository + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + repositoryURL: + description: |- + RepositoryURL is the URL helm chart repository + It can point to a traditional HTTP-based repository or an OCI registry. + Examples: + - HTTP Repository: https://charts.example.com/stable + - OCI Registry: oci://registry.example.com/namespace/charts + - GitHub Pages: https://.github.io// + - Any other valid URL where Helm charts are hosted. + + Alternatively, it can be a Flux source reference: + ://// + + Where: + - is the type of Flux source (gitrepository, ocirepository, bucket). + - and are the namespace and name of the Flux Source in the management cluster. + - is the path within the source repository where the Helm charts are located. + + For instance: + gitrepository://flux-system/flux-system/charts/projectsveltos + + Assuming there is a Flux GitRepository named 'flux-system' in the 'flux-system' namespace + syncing 'https://github.com/projectsveltos/helm-charts.git/', and the Helm charts are + located in the 'charts/projectsveltos' directory of that repository. + minLength: 1 + type: string + signatureVerification: + description: |- + SignatureVerification configures Cosign-based signature verification for OCI Helm charts. + Ignored when RepositoryURL does not start with "oci://". + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity lists OIDC identity matchers for keyless verification. + At least one matcher must be satisfied. Required when Provider is Keyless. + items: + description: OIDCIdentityMatcher specifies the expected + OIDC issuer and subject for keyless Cosign verification. + properties: + issuer: + description: Issuer is the OIDC issuer URL or + regex. + minLength: 1 + type: string + subject: + description: Subject is the OIDC subject or regex, + typically the workload identity or GitHub Actions + workflow URL. + minLength: 1 + type: string + required: + - issuer + - subject + type: object + type: array + provider: + description: Provider specifies how to obtain the verification + key or certificate. + enum: + - PublicKey + - Keyless + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing the Cosign public key. + The Secret must have a key named "cosign.pub" holding a PEM-encoded public key. + Required when Provider is PublicKey. + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - provider + type: object + values: + description: |- + Values field allows to define configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + required: + - releaseName + - releaseNamespace + - repositoryURL + type: object + x-kubernetes-validations: + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartName) + >= 1 : true' + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartName) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartVersion) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartVersion) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.repositoryName) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.repositoryName) + >= 1 : true' + type: array + x-kubernetes-list-type: atomic + kustomizationRefs: + description: |- + Kustomization refs is a list of kustomization paths. Kustomization will + be run on those paths and the outcome will be deployed. + items: + properties: + components: + description: |- + Components is a list of paths to Kustomize components. These paths are relative to the + ` + "`" + `Path` + "`" + ` field and are included in the Kustomize build to provide reusable configuration logic. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + type: string + type: array + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + NOTE: DeploymentType Local cannot be used when the matching cluster is the management cluster itself. + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + KustomizationRef when an update is rejected with an error that only a delete+recreate + can resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - flux GitRepository;OCIRepository;Bucket + - ConfigMap/Secret + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS + endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket + or a ConfigMap/Secret. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the remote source serving the Kustomize directory content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball + (.tar.gz) of the Kustomize directory + "oci://" — OCI registry artifact whose layers are extracted + the same way, preserving the directory tree + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this KustomizationRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different KustomizationRef + within the same ClusterProfile or Profile. + When two KustomizationRef attempt to deploy the same resource, the KustomizationRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + values: + additionalProperties: + type: string + description: |- + Values is a map[string]string type that allows to define a set of key-value pairs. + These key-value pairs can optionally leverage Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + type: object + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to define key-value pairs. These key-value pairs can optionally leverage + Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + maxConsecutiveFailures: + description: |- + The maximum number of consecutive deployment failures that Sveltos will permit. + After this many consecutive failures, the deployment will be considered failed, and Sveltos will stop retrying. + This setting applies only to feature deployments, not resource removal. + This field is optional. If not set, Sveltos default behavior is to keep retrying. + type: integer + maxUpdate: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of clusters that can be updated concurrently. + Value can be an absolute number (ex: 5) or a percentage of desired cluster (ex: 10%). + Defaults to 100%. + Example: when this is set to 30%, when list of add-ons/applications in ClusterProfile + changes, only 30% of matching clusters will be updated in parallel. Only when updates + in those cluster succeed, other matching clusters are updated. + pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ + x-kubernetes-int-or-string: true + patches: + description: |- + Define additional Kustomize inline Patches applied for all resources on this profile + Within the Patch Spec you can use templating + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + target: + description: Target points to the resources that the patch + document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + x-kubernetes-list-type: atomic + patchesFrom: + description: |- + PatchesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store additional Kustomize inline Patches applied for all resources on this profile + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + x-kubernetes-list-type: atomic + policyRefs: + description: |- + PolicyRefs references all the ConfigMaps/Secrets/Flux Sources containing kubernetes resources + that need to be deployed in the matching managed clusters. + The values contained in those resources can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + postDeleteChecks: + description: |- + PostDeleteChecks is a slice of checks to run against the managed cluster + *after* Sveltos has deleted all resources. + This ensures that the environment has reached the desired clean state. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeleteChecks: + description: |- + PreDeleteChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deleting resources. + If any of these fail, the deletion process is halted. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeployChecks: + description: |- + PreDeployChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deploying resources. + Each check can use Lua scripts or CEL expressions to validate the cluster state. + If any check fails, the deployment of the associated feature is halted. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + reloader: + default: false + description: |- + Reloader indicates whether Deployment/StatefulSet/DaemonSet instances deployed + by Sveltos and part of this ClusterProfile need to be restarted via rolling upgrade + when a ConfigMap/Secret instance mounted as volume is modified. + When set to true, when any mounted ConfigMap/Secret is modified, Sveltos automatically + starts a rolling upgrade for Deployment/StatefulSet/DaemonSet instances mounting it. + type: boolean + stopMatchingBehavior: + default: WithdrawPolicies + description: |- + StopMatchingBehavior indicates what behavior should be when a Cluster stop matching + the ClusterProfile. By default all deployed Helm charts and Kubernetes resources will + be withdrawn from Cluster. Setting StopMatchingBehavior to LeavePolicies will instead + leave ClusterProfile deployed policies in the Cluster. + enum: + - WithdrawPolicies + - LeavePolicies + type: string + syncMode: + default: Continuous + description: |- + SyncMode specifies how features are synced in a matching workload cluster. + - OneTime means, first time a workload cluster matches the ClusterProfile, + features will be deployed in such cluster. Any subsequent feature configuration + change won't be applied into the matching workload clusters; + - Continuous mode ensures that the first time a workload cluster matches a ClusterProfile, + the specified features are deployed. Subsequent changes to the feature configuration are also + automatically applied to all matching workload clusters. + _ SyncModeContinuousWithDriftDetection operates similarly to Continuous mode, but also monitors + matching managed clusters for configuration drift. If drift is detected, a reconciliation is + triggered to ensure the managed cluster's configuration aligns with the ClusterProfile. + - DryRun means no change will be propagated to any matching cluster. A report + instead will be generated summarizing what would happen in any matching cluster + because of the changes made to ClusterProfile while in DryRun mode. + enum: + - OneTime + - Continuous + - ContinuousWithDriftDetection + - DryRun + type: string + templateResourceRefs: + description: |- + TemplateResourceRefs is a list of resource to collect from the management cluster. + Those resources' values will be used to instantiate templates + items: + properties: + identifier: + description: |- + Identifier is how the resource will be referred to in the + template + type: string + ignoreStatusChanges: + default: false + description: |- + IgnoreStatusChanges indicates whether changes to the status of the referenced + resource should be ignored. If set to true, only changes to the spec or + metadata (generation change) will trigger a reconciliation. + type: boolean + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other TemplateResourceRefs. + type: boolean + resource: + description: |- + Resource references a Kubernetes instance in the management + cluster to fetch and use during template instantiation. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + Name and namespace can be expressed as a template and instantiate using any cluster field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + watchFields: + description: |- + WatchFields is an optional list of dot-separated field paths to include + when computing the hash for this resource (e.g. "status.readyReplicas", + "metadata.labels"). When non-empty, only the listed fields are hashed and + IgnoreStatusChanges is ignored. Use this when you need to react to a + specific field without being sensitive to every other change on the object. + items: + type: string + type: array + required: + - identifier + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - identifier + x-kubernetes-list-type: map + tier: + default: 100 + description: |- + Tier controls the order of deployment for ClusterProfile or Profile resources targeting + the same cluster resources. + Imagine two configurations (ClusterProfiles or Profiles) trying to deploy the same resource (a Kubernetes + resource or an helm chart). By default, the first one to reach the cluster "wins" and deploys it. + Tier allows you to override this. When conflicts arise, the ClusterProfile or Profile with the **lowest** + Tier value takes priority and deploys the resource. + Higher Tier values represent lower priority. The default Tier value is 100. + Using Tiers provides finer control over resource deployment within your cluster, particularly useful + when multiple configurations manage the same resources. + format: int32 + minimum: 1 + type: integer + validateHealths: + description: |- + ValidateHealths is a slice of checks to run against the managed cluster + *after* resources are deployed to validate that the state of the + add-ons/applications is healthy. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + stages: + description: |- + Stages is a list of environments in the promotion pipeline. + The pipeline will progress through these stages in the order they are defined. + items: + description: Stage defines a single step in the promotion pipeline + properties: + clusterSelector: + description: ClusterSelector specifies which clusters this stage's + resources will be deployed to. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: Name of the stage, e.g., "qa", "staging", "production". + type: string + trigger: + description: |- + Trigger for promoting to the next stage in the pipeline. + This field is only applicable to stages that are not the last stage. + properties: + auto: + description: |- + Auto is an automatic trigger. When set, promotion occurs automatically + based on defined conditions. + properties: + delay: + description: |- + Delay is an optional time duration to wait after the WaitForStatus condition + is met before proceeding with the promotion. + type: string + postDelayHealthChecks: + description: |- + PostDelayHealthChecks is a slice of health checks Sveltos will run after the delay + period has elapsed. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule + used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier + for the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources + based on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison + operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query + expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace + to reference a secret resource. + type: string + namespace: + description: namespace defines the space + within which the secret name must be + unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + preHealthCheckDeployment: + description: |- + PreHealthCheckDeployment is a slice of resources Sveltos will deploy after the Delay + period has elapsed and before running PostDelayHealthChecks. + This can be used, for example, to deploy a Job that performs validation tasks. + The PostDelayHealthChecks can then validate the successful completion of these resources (e.g., a Job). + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace + to reference a secret resource. + type: string + namespace: + description: namespace defines the space + within which the secret name must be + unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but + not both + rule: has(self.remoteURL) != has(self.kind) + type: array + promotionWindow: + description: |- + PromotionWindow defines the recurring time window during which the + automatic promotion is permitted. The controller evaluates this window + *only after* the Delay (if defined) has elapsed and all PostDelayHealthChecks + have passed. The controller will then wait until the window defined by From/To + is open before proceeding. + properties: + from: + description: |- + From is a cron expression defining the recurring time(s) when the promotion + window opens. The promotion will be blocked until the time defined by 'From' + is reached. + minLength: 1 + type: string + to: + description: |- + To is a cron expression defining the recurring time(s) when the promotion + window closes. If the promotion process is not complete when 'To' is reached, + the controller should pause and wait for the next 'From' time. + minLength: 1 + type: string + required: + - from + - to + type: object + type: object + manual: + description: Manual is a manual trigger. When set, promotion + requires a human signal. + properties: + approved: + description: |- + Approved, when set to true, signals to the controller that + promotion to the next stage is approved. + type: boolean + automaticReset: + default: true + description: |- + AutomaticReset, when set to true, instructs the controller to automatically + reset the 'Approved' field to nil/false after successfully promoting + to the next stage. This prevents unintended immediate advancement + past the next manual stage. Defaults to true. + type: boolean + delay: + description: |- + Delay is an optional time duration to wait after the WaitForStatus condition + is met before proceeding with the promotion. + type: string + postDelayHealthChecks: + description: |- + PostDelayHealthChecks is a slice of health checks Sveltos will run after the delay + period has elapsed. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule + used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier + for the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources + based on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison + operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query + expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace + to reference a secret resource. + type: string + namespace: + description: namespace defines the space + within which the secret name must be + unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + preHealthCheckDeployment: + description: |- + PreHealthCheckDeployment is a slice of resources Sveltos will deploy after the Delay + period has elapsed and before running PostDelayHealthChecks. + This can be used, for example, to deploy a Job that performs validation tasks. + The PostDelayHealthChecks can then validate the successful completion of these resources (e.g., a Job). + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace + to reference a secret resource. + type: string + namespace: + description: namespace defines the space + within which the secret name must be + unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but + not both + rule: has(self.remoteURL) != has(self.kind) + type: array + type: object + type: object + x-kubernetes-validations: + - message: A trigger must have either a 'manual' or 'auto' field, + but not both. + rule: has(self.manual) != has(self.auto) + required: + - name + type: object + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - stages + type: object + status: + description: status defines the observed state of ClusterPromotion + properties: + currentStageName: + description: |2- + If the pipeline is currently running, this is the name of the stage + being processed. If the pipeline is paused or completed, this is the name + of the last stage that reached a target state. + type: string + lastPromotionTime: + description: LastPromotionTime is the time the entire promotion process + was successfully completed. + format: date-time + type: string + profileSpecHash: + description: |- + ProfileSpecHash represents a unique value for the entire ProfileSpec configuration + at a fixed point in time. This is used to detect configuration changes. + format: byte + type: string + stages: + description: |- + Stages tracks the status of each configured promotion stage + (e.g., "qa", "staging", "production"). + items: + description: StageStatus defines the status for a given stage in + a progressive deployment. + properties: + currentStatusDescription: + description: |- + CurrentStatusDescription provides a high-level description of where the stage is + in its progression (e.g., "Waiting for cluster profiles to be created", + "Waiting for all clusters to be Provisioned", "Running post-deployment health checks"). + This helps users understand the current blocking state. + type: string + failureMessage: + description: FailureMessage reports a detailed error message + if a failure occurred. + type: string + lastStatusCheckTime: + description: |- + LastStatusCheckTime is the time the ClusterPromotion controller last checked the + statuses of the matching clusters and their provisioned state. + This is updated frequently while waiting for provisioning to complete. + format: date-time + type: string + lastSuccessfulAppliedTime: + description: |- + LastSuccessfulAppliedTime is the time this stage was fully and successfully deployed. + This means all clusters matching the stage have reported a 'Provisioned' status. + format: date-time + type: string + lastUpdateReconciledTime: + description: |- + LastUpdateReconciledTime is the time the ClusterPromotion controller most recently + created or updated the corresponding ClusterProfile resource for this stage. + This indicates when the desired state was last applied to the system. + format: date-time + type: string + name: + description: Name of the stage, e.g., "qa", "staging", "production". + type: string + required: + - name + type: object + type: array + stagesHash: + description: |- + StagesHash represents a unique value for the entire list of Stages. + This hash changes if any stage is added, removed, or if the ordering + or configuration (ClusterSelector, Trigger) of any stage changes. + format: byte + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +`) diff --git a/lib/crd/clusterreports.go b/lib/crd/clusterreports.go new file mode 100644 index 00000000..4bcc516b --- /dev/null +++ b/lib/crd/clusterreports.go @@ -0,0 +1,329 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ClusterReportFile = "../../config/crd/bases/config.projectsveltos.io_clusterreports.yaml" +var ClusterReportCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: clusterreports.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: ClusterReport + listKind: ClusterReportList + plural: clusterreports + singular: clusterreport + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterReport is the Schema for the clusterreports API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ClusterReportSpec defines the desired state of ClusterReport + properties: + clusterName: + description: |- + ClusterName is the name of the CAPI Cluster this ClusterReport + is for. + type: string + clusterNamespace: + description: |- + ClusterNamespace is the namespace of the CAPI Cluster this + ClusterReport is for. + type: string + required: + - clusterName + - clusterNamespace + type: object + status: + description: ClusterReportStatus defines the observed state of ClusterReport + properties: + helmResourceReports: + description: |- + HelmResourceReports contains report on helm resources (when in pull mode, helm template resources are + deployed directly) + items: + properties: + action: + description: Action represent the type of operation on the Kubernetes + resource. + enum: + - No Action + - Create + - Update + - Delete + - Conflict + - Error + type: string + message: + description: |- + Message is for any message that needs to added to better + explain the action. + type: string + resource: + description: Resource contains information about Kubernetes + Resource + properties: + group: + description: Group of the resource deployed in the Cluster. + type: string + ignoreForConfigurationDrift: + default: false + description: |- + IgnoreForConfigurationDrift indicates to not track resource + for configuration drift detection. + This field has a meaning only when mode is ContinuousWithDriftDetection + type: boolean + kind: + description: Kind of the resource deployed in the Cluster. + minLength: 1 + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this resource + was last applied to the cluster. + format: date-time + type: string + name: + description: Name of the resource deployed in the Cluster. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the resource deployed in the Cluster. + Empty for resources scoped at cluster level. + type: string + version: + description: Version of the resource deployed in the Cluster. + minLength: 1 + type: string + required: + - group + - kind + - name + - version + type: object + required: + - resource + type: object + type: array + kustomizeResourceReports: + description: |- + KustomizeResourceReports contains report on Kubernetes resources + deployed because of KustomizationRefs + items: + properties: + action: + description: Action represent the type of operation on the Kubernetes + resource. + enum: + - No Action + - Create + - Update + - Delete + - Conflict + - Error + type: string + message: + description: |- + Message is for any message that needs to added to better + explain the action. + type: string + resource: + description: Resource contains information about Kubernetes + Resource + properties: + group: + description: Group of the resource deployed in the Cluster. + type: string + ignoreForConfigurationDrift: + default: false + description: |- + IgnoreForConfigurationDrift indicates to not track resource + for configuration drift detection. + This field has a meaning only when mode is ContinuousWithDriftDetection + type: boolean + kind: + description: Kind of the resource deployed in the Cluster. + minLength: 1 + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this resource + was last applied to the cluster. + format: date-time + type: string + name: + description: Name of the resource deployed in the Cluster. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the resource deployed in the Cluster. + Empty for resources scoped at cluster level. + type: string + version: + description: Version of the resource deployed in the Cluster. + minLength: 1 + type: string + required: + - group + - kind + - name + - version + type: object + required: + - resource + type: object + type: array + releaseReports: + description: ReleaseReports contains report on helm releases + items: + properties: + action: + description: Action represent the type of operation on the Helm + Chart + enum: + - No Action + - Install + - Upgrade + - Delete + - Conflict + - Update Values + type: string + chartName: + description: ReleaseName of the release deployed in the CAPI + Cluster. + minLength: 1 + type: string + chartVersion: + description: |- + ChartVersion is the version of the helm chart deployed + in the CAPI Cluster. + type: string + message: + description: |- + Message is for any message that needs to added to better + explain the action. + type: string + releaseNamespace: + description: Namespace where release is deployed in the CAPI + Cluster. + minLength: 1 + type: string + required: + - chartName + - chartVersion + - releaseNamespace + type: object + type: array + resourceReports: + description: |- + ResourceReports contains report on Kubernetes resources + deployed because of PolicyRefs + items: + properties: + action: + description: Action represent the type of operation on the Kubernetes + resource. + enum: + - No Action + - Create + - Update + - Delete + - Conflict + - Error + type: string + message: + description: |- + Message is for any message that needs to added to better + explain the action. + type: string + resource: + description: Resource contains information about Kubernetes + Resource + properties: + group: + description: Group of the resource deployed in the Cluster. + type: string + ignoreForConfigurationDrift: + default: false + description: |- + IgnoreForConfigurationDrift indicates to not track resource + for configuration drift detection. + This field has a meaning only when mode is ContinuousWithDriftDetection + type: boolean + kind: + description: Kind of the resource deployed in the Cluster. + minLength: 1 + type: string + lastAppliedTime: + description: LastAppliedTime identifies when this resource + was last applied to the cluster. + format: date-time + type: string + name: + description: Name of the resource deployed in the Cluster. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the resource deployed in the Cluster. + Empty for resources scoped at cluster level. + type: string + version: + description: Version of the resource deployed in the Cluster. + minLength: 1 + type: string + required: + - group + - kind + - name + - version + type: object + required: + - resource + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +`) diff --git a/lib/crd/clustersummaries.go b/lib/crd/clustersummaries.go new file mode 100644 index 00000000..454892f8 --- /dev/null +++ b/lib/crd/clustersummaries.go @@ -0,0 +1,2395 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ClusterSummaryFile = "../../config/crd/bases/config.projectsveltos.io_clustersummaries.yaml" +var ClusterSummaryCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: clustersummaries.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: ClusterSummary + listKind: ClusterSummaryList + plural: clustersummaries + singular: clustersummary + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of ClusterSummary + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Indicates whether HelmCharts are all provisioned + jsonPath: .status.featureSummaries[?(@.featureID=="Helm")].status + name: HelmCharts + priority: 2 + type: string + - description: Indicates whether KustomizeRefs are all provisioned + jsonPath: .status.featureSummaries[?(@.featureID=="Kustomize")].status + name: KustomizeRefs + priority: 2 + type: string + - description: Indicates whether PolicyRefs are all provisioned + jsonPath: .status.featureSummaries[?(@.featureID=="Resources")].status + name: PolicyRefs + priority: 2 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterSummary is the Schema for the clustersummaries API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ClusterSummarySpec defines the desired state of ClusterSummary + properties: + clusterName: + description: ClusterName is the name of the workload Cluster this + ClusterSummary is for. + type: string + clusterNamespace: + description: |- + ClusterNamespace is the namespace of the workload Cluster this + ClusterSummary is for. + type: string + clusterProfileSpec: + description: |- + ClusterProfileSpec represent the configuration that will be applied to + the workload cluster. + properties: + clusterRefs: + description: ClusterRefs identifies clusters to associate to. + items: + description: ObjectReference contains enough information to + let you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + clusterSelector: + description: ClusterSelector identifies clusters to associate + to. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + continueOnConflict: + default: false + description: |- + By default (when ContinueOnConflict is unset or set to false), Sveltos stops deployment after + encountering the first conflict (e.g., another ClusterProfile already deployed the resource). + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if conflicts are detected for previous resources. + type: boolean + continueOnError: + default: false + description: |- + By default (when ContinueOnError is unset or set to false), Sveltos stops deployment after + encountering the first error. + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if errors are detected for previous resources. + type: boolean + dependsOn: + description: |- + DependsOn specifies a list of other profiles that this instance depends on. + A ClusterProfile can only depend on other ClusterProfiles, and a Profile can + only depend on other Profiles. + The add-ons and applications defined in this instance will not be deployed + until all add-ons and applications in the profiles listed as dependencies are deployed. + items: + type: string + type: array + driftExclusions: + description: |- + DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is + set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore + when evaluating drift, optionally targeting specific resources and features. + items: + properties: + paths: + description: Paths is a slice of JSON6902 paths to exclude + from configuration drift evaluation. + items: + type: string + type: array + target: + description: Target points to the resources that the paths + refers to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + x-kubernetes-list-type: atomic + extraAnnotations: + additionalProperties: + type: string + description: |- + ExtraAnnotations: These annotations will be added by Sveltos to all Kubernetes resources + deployed in a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a annotation with a key present in + ` + "`" + `ExtraAnnotations` + "`" + `, the value from ` + "`" + `ExtraAnnotations` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + extraLabels: + additionalProperties: + type: string + description: |- + ExtraLabels: These labels will be added by Sveltos to all Kubernetes resources deployed in + a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a label with a key present in + ` + "`" + `ExtraLabels` + "`" + `, the value from ` + "`" + `ExtraLabels` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + helmCharts: + description: Helm charts is a list of helm charts that need to + be deployed + items: + properties: + chartName: + description: |- + ChartName is the chart name + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + Must be defined otherwise. + type: string + chartVersion: + description: |- + ChartVersion is the chart version + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + helmChartAction: + default: Install + description: HelmChartAction is the action that will be + taken on the helm chart + enum: + - Install + - Uninstall + type: string + options: + description: Options allows to set flags which are used + during installation. + properties: + atomic: + default: false + description: |- + if set, the installation process deletes the installation/upgrades on failure. + The --wait flag will be set automatically if --atomic is used + Default to false + type: boolean + dependencyUpdate: + default: false + description: |- + update dependencies if they are missing before installing the chart + Default to false + type: boolean + description: + description: Description is the description of an helm + operation + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install/upgrade/uninstall + Default to false + type: boolean + disableOpenAPIValidation: + default: false + description: |- + if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema + Default to false + type: boolean + enableClientCache: + default: false + description: EnableClientCache is a flag to enable Helm + client cache. If it is not specified, it will be set + to false. + type: boolean + installOptions: + description: HelmInstallOptions are options specific + to helm install + properties: + createNamespace: + default: true + description: Create the release namespace if not + present. Defaults to true + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on install + Default to false + type: boolean + replace: + default: true + description: Replaces if set indicates to replace + an older release with this one + type: boolean + takeOwnership: + default: false + description: |- + if set, install will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Labels that would be added to release metadata. + type: object + passCredentialsAll: + description: PassCredentialsAll is the flag to pass + credentials to all domains + type: boolean + postRenderStrategy: + description: |- + PostRenderStrategy controls whether Helm hooks are included when Patches/PatchesFrom + are applied as a post-renderer during this chart's install/upgrade. Only relevant + when Patches or PatchesFrom is set on the Spec; ignored otherwise. Defaults to + Helm's own default (combined) when unset. + enum: + - combined + - separate + - nohooks + type: string + runTests: + default: false + description: |- + RunTests if set to true, Sveltos will run helm test after each successful install or upgrade + operation. The tests are the test hooks defined in the chart (annotated with + "helm.sh/hook: test"). If any test fails the deployment is considered failed and the + error is surfaced in the ClusterSummary status, providing operational gating. + Has no effect in DryRun mode. + Default to false + type: boolean + skipCRDs: + default: false + description: |- + SkipCRDs controls whether CRDs should be installed during install/upgrade operation. + By default, CRDs are installed if not already present. + type: boolean + skipSchemaValidation: + default: false + description: SkipSchemaValidation determines if JSON + schema validation is disabled. + type: boolean + timeout: + description: time to wait for any individual Kubernetes + operation (like Jobs for hooks) (default 5m0s) + type: string + uninstallOptions: + description: HelmUninstallOptions are options specific + to helm uninstall + properties: + deletionPropagation: + description: DeletionPropagation + enum: + - orphan + - foreground + - background + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on uninstall + Default to false + type: boolean + keepHistory: + description: |- + When uninstall a chart with this flag, Helm removes the resources associated with the chart, + but it keeps the release information. This allows to see details about the uninstalled release + using the helm history command. + type: boolean + type: object + upgradeOptions: + description: HelmUpgradeOptions are options specific + to helm upgrade + properties: + cleanupOnFail: + default: false + description: CleanupOnFail will, if true, cause + the upgrade to delete newly-created resources + on a failed update. + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on upgrade + Default to false + type: boolean + force: + default: false + description: |- + Force will, if set to ` + "`" + `true` + "`" + `, ignore certain warnings and perform the upgrade anyway. + This should be used with caution. + type: boolean + maxHistory: + default: 2 + description: |- + MaxHistory limits the maximum number of revisions saved per release + Default to 2 + type: integer + recreate: + default: false + description: |- + Recreate will (if true) recreate pods after a rollback. + + Deprecated: This field is no longer supported + type: boolean + resetThenReuseValues: + default: false + description: ResetThenReuseValues will reset the + values to the chart's built-ins then merge with + user's last supplied values. + type: boolean + resetValues: + default: false + description: ResetValues will reset the values to + the chart's built-ins rather than merging with + existing. + type: boolean + reuseValues: + default: false + description: |- + ReuseValues copies values from the current release to a new release if the + new release does not have any values. If the request already has values, + or if there are no values in the current release, this does nothing. + This is skipped if the ResetValues flag is set, in which case the + request values are not altered. + type: boolean + subNotes: + default: false + description: SubNotes determines whether sub-notes + are rendered in the chart. + type: boolean + takeOwnership: + default: false + description: |- + if set, upgrade will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + upgradeCRDs: + default: false + description: |- + UpgradeCRDs upgrade CRDs from the Helm Chart's crds directory + By default, CRDs are not applied during Helm upgrade action by Helm + https://helm.sh/docs/chart_best_practices/custom_resource_definitions/ + type: boolean + type: object + wait: + default: false + description: |- + if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet + are in a ready state before marking the release as successful. It will wait for as long as --timeout + Default to false + type: boolean + waitForJobs: + default: false + description: |- + if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. + It will wait for as long as --timeout + Default to false + type: boolean + type: object + provenanceVerification: + description: |- + ProvenanceVerification configures Helm GPG .prov file verification for HTTP chart repositories. + Ignored for OCI and Flux-sourced charts. + properties: + keyringSecretRef: + description: |- + KeyringSecretRef references a Secret in the management cluster containing the GPG keyring. + The Secret must have a key named "keyring.gpg". + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - keyringSecretRef + type: object + registryCredentialsConfig: + description: |- + RegistryCredentialsConfig is an optional configuration for credentials, + including information to connect to private registries. + properties: + ca: + description: |- + CASecretRef references a secret containing the TLS CA certificate + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + key: ca.crt + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + credentials: + description: |- + CredentialsSecretRef references a secret containing credentials + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + insecureSkipTLSVerify: + description: InsecureSkipTLSVerify controls server certificate + verification. + type: boolean + key: + description: |- + Key specifies the key within the CredentialsSecretRef containing the data + If not specified, it defaults to the only key in the secret if there's just one. + type: string + plainHTTP: + description: PlainHTTP indicates to use insecure HTTP + connections for the chart download + type: boolean + type: object + releaseName: + description: ReleaseName is the chart release + minLength: 1 + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace release will + be installed + minLength: 1 + type: string + repositoryName: + description: |- + RepositoryName is the name helm chart repository + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + repositoryURL: + description: |- + RepositoryURL is the URL helm chart repository + It can point to a traditional HTTP-based repository or an OCI registry. + Examples: + - HTTP Repository: https://charts.example.com/stable + - OCI Registry: oci://registry.example.com/namespace/charts + - GitHub Pages: https://.github.io// + - Any other valid URL where Helm charts are hosted. + + Alternatively, it can be a Flux source reference: + ://// + + Where: + - is the type of Flux source (gitrepository, ocirepository, bucket). + - and are the namespace and name of the Flux Source in the management cluster. + - is the path within the source repository where the Helm charts are located. + + For instance: + gitrepository://flux-system/flux-system/charts/projectsveltos + + Assuming there is a Flux GitRepository named 'flux-system' in the 'flux-system' namespace + syncing 'https://github.com/projectsveltos/helm-charts.git/', and the Helm charts are + located in the 'charts/projectsveltos' directory of that repository. + minLength: 1 + type: string + signatureVerification: + description: |- + SignatureVerification configures Cosign-based signature verification for OCI Helm charts. + Ignored when RepositoryURL does not start with "oci://". + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity lists OIDC identity matchers for keyless verification. + At least one matcher must be satisfied. Required when Provider is Keyless. + items: + description: OIDCIdentityMatcher specifies the expected + OIDC issuer and subject for keyless Cosign verification. + properties: + issuer: + description: Issuer is the OIDC issuer URL or + regex. + minLength: 1 + type: string + subject: + description: Subject is the OIDC subject or regex, + typically the workload identity or GitHub Actions + workflow URL. + minLength: 1 + type: string + required: + - issuer + - subject + type: object + type: array + provider: + description: Provider specifies how to obtain the verification + key or certificate. + enum: + - PublicKey + - Keyless + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing the Cosign public key. + The Secret must have a key named "cosign.pub" holding a PEM-encoded public key. + Required when Provider is PublicKey. + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - provider + type: object + values: + description: |- + Values field allows to define configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + required: + - releaseName + - releaseNamespace + - repositoryURL + type: object + x-kubernetes-validations: + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartName) + >= 1 : true' + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartName) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartVersion) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartVersion) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.repositoryName) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.repositoryName) + >= 1 : true' + type: array + x-kubernetes-list-type: atomic + kustomizationRefs: + description: |- + Kustomization refs is a list of kustomization paths. Kustomization will + be run on those paths and the outcome will be deployed. + items: + properties: + components: + description: |- + Components is a list of paths to Kustomize components. These paths are relative to the + ` + "`" + `Path` + "`" + ` field and are included in the Kustomize build to provide reusable configuration logic. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + type: string + type: array + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + NOTE: DeploymentType Local cannot be used when the matching cluster is the management cluster itself. + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + KustomizationRef when an update is rejected with an error that only a delete+recreate + can resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - flux GitRepository;OCIRepository;Bucket + - ConfigMap/Secret + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS + endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket + or a ConfigMap/Secret. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the remote source serving the Kustomize directory content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball + (.tar.gz) of the Kustomize directory + "oci://" — OCI registry artifact whose layers are extracted + the same way, preserving the directory tree + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this KustomizationRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different KustomizationRef + within the same ClusterProfile or Profile. + When two KustomizationRef attempt to deploy the same resource, the KustomizationRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + values: + additionalProperties: + type: string + description: |- + Values is a map[string]string type that allows to define a set of key-value pairs. + These key-value pairs can optionally leverage Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + type: object + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to define key-value pairs. These key-value pairs can optionally leverage + Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + maxConsecutiveFailures: + description: |- + The maximum number of consecutive deployment failures that Sveltos will permit. + After this many consecutive failures, the deployment will be considered failed, and Sveltos will stop retrying. + This setting applies only to feature deployments, not resource removal. + This field is optional. If not set, Sveltos default behavior is to keep retrying. + type: integer + maxUpdate: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of clusters that can be updated concurrently. + Value can be an absolute number (ex: 5) or a percentage of desired cluster (ex: 10%). + Defaults to 100%. + Example: when this is set to 30%, when list of add-ons/applications in ClusterProfile + changes, only 30% of matching clusters will be updated in parallel. Only when updates + in those cluster succeed, other matching clusters are updated. + pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ + x-kubernetes-int-or-string: true + patches: + description: |- + Define additional Kustomize inline Patches applied for all resources on this profile + Within the Patch Spec you can use templating + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + target: + description: Target points to the resources that the patch + document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + x-kubernetes-list-type: atomic + patchesFrom: + description: |- + PatchesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store additional Kustomize inline Patches applied for all resources on this profile + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + x-kubernetes-list-type: atomic + policyRefs: + description: |- + PolicyRefs references all the ConfigMaps/Secrets/Flux Sources containing kubernetes resources + that need to be deployed in the matching managed clusters. + The values contained in those resources can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + postDeleteChecks: + description: |- + PostDeleteChecks is a slice of checks to run against the managed cluster + *after* Sveltos has deleted all resources. + This ensures that the environment has reached the desired clean state. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeleteChecks: + description: |- + PreDeleteChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deleting resources. + If any of these fail, the deletion process is halted. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeployChecks: + description: |- + PreDeployChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deploying resources. + Each check can use Lua scripts or CEL expressions to validate the cluster state. + If any check fails, the deployment of the associated feature is halted. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + reloader: + default: false + description: |- + Reloader indicates whether Deployment/StatefulSet/DaemonSet instances deployed + by Sveltos and part of this ClusterProfile need to be restarted via rolling upgrade + when a ConfigMap/Secret instance mounted as volume is modified. + When set to true, when any mounted ConfigMap/Secret is modified, Sveltos automatically + starts a rolling upgrade for Deployment/StatefulSet/DaemonSet instances mounting it. + type: boolean + setRefs: + description: |- + SetRefs identifies referenced (cluster)Sets. + - ClusterProfile can reference ClusterSet; + - Profile can reference Set; + items: + type: string + type: array + stopMatchingBehavior: + default: WithdrawPolicies + description: |- + StopMatchingBehavior indicates what behavior should be when a Cluster stop matching + the ClusterProfile. By default all deployed Helm charts and Kubernetes resources will + be withdrawn from Cluster. Setting StopMatchingBehavior to LeavePolicies will instead + leave ClusterProfile deployed policies in the Cluster. + enum: + - WithdrawPolicies + - LeavePolicies + type: string + syncMode: + default: Continuous + description: |- + SyncMode specifies how features are synced in a matching workload cluster. + - OneTime means, first time a workload cluster matches the ClusterProfile, + features will be deployed in such cluster. Any subsequent feature configuration + change won't be applied into the matching workload clusters; + - Continuous mode ensures that the first time a workload cluster matches a ClusterProfile, + the specified features are deployed. Subsequent changes to the feature configuration are also + automatically applied to all matching workload clusters. + _ SyncModeContinuousWithDriftDetection operates similarly to Continuous mode, but also monitors + matching managed clusters for configuration drift. If drift is detected, a reconciliation is + triggered to ensure the managed cluster's configuration aligns with the ClusterProfile. + - DryRun means no change will be propagated to any matching cluster. A report + instead will be generated summarizing what would happen in any matching cluster + because of the changes made to ClusterProfile while in DryRun mode. + enum: + - OneTime + - Continuous + - ContinuousWithDriftDetection + - DryRun + type: string + templateResourceRefs: + description: |- + TemplateResourceRefs is a list of resource to collect from the management cluster. + Those resources' values will be used to instantiate templates + items: + properties: + identifier: + description: |- + Identifier is how the resource will be referred to in the + template + type: string + ignoreStatusChanges: + default: false + description: |- + IgnoreStatusChanges indicates whether changes to the status of the referenced + resource should be ignored. If set to true, only changes to the spec or + metadata (generation change) will trigger a reconciliation. + type: boolean + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other TemplateResourceRefs. + type: boolean + resource: + description: |- + Resource references a Kubernetes instance in the management + cluster to fetch and use during template instantiation. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + Name and namespace can be expressed as a template and instantiate using any cluster field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + watchFields: + description: |- + WatchFields is an optional list of dot-separated field paths to include + when computing the hash for this resource (e.g. "status.readyReplicas", + "metadata.labels"). When non-empty, only the listed fields are hashed and + IgnoreStatusChanges is ignored. Use this when you need to react to a + specific field without being sensitive to every other change on the object. + items: + type: string + type: array + required: + - identifier + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - identifier + x-kubernetes-list-type: map + tier: + default: 100 + description: |- + Tier controls the order of deployment for ClusterProfile or Profile resources targeting + the same cluster resources. + Imagine two configurations (ClusterProfiles or Profiles) trying to deploy the same resource (a Kubernetes + resource or an helm chart). By default, the first one to reach the cluster "wins" and deploys it. + Tier allows you to override this. When conflicts arise, the ClusterProfile or Profile with the **lowest** + Tier value takes priority and deploys the resource. + Higher Tier values represent lower priority. The default Tier value is 100. + Using Tiers provides finer control over resource deployment within your cluster, particularly useful + when multiple configurations manage the same resources. + format: int32 + minimum: 1 + type: integer + validateHealths: + description: |- + ValidateHealths is a slice of checks to run against the managed cluster + *after* resources are deployed to validate that the state of the + add-ons/applications is healthy. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in + EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for + the rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based + on current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within + which the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + clusterType: + description: ClusterType is the type of Cluster + type: string + required: + - clusterName + - clusterNamespace + - clusterType + type: object + status: + description: ClusterSummaryStatus defines the observed state of ClusterSummary + properties: + dependencies: + description: |- + Dependencies is a summary reporting the status of the dependencies + for the associated ClusterProfile + type: string + deployedGVKs: + description: |- + DeployedGVKs reports the list of GVKs deployed by ClusterSummary + in a managed cluster + items: + properties: + deployedGroupVersionKind: + description: |- + DeployedGroupVersionKind contains all GroupVersionKinds deployed in either + the workload cluster or the management cluster because of this feature. + Each element has format kind.version.group + items: + type: string + type: array + featureID: + description: FeatureID is an indentifier of the feature whose + status is reported + enum: + - Resources + - Helm + - Kustomize + type: string + required: + - featureID + type: object + type: array + x-kubernetes-list-map-keys: + - featureID + x-kubernetes-list-type: map + failureMessage: + description: |- + FailureMessage reports any error encountered during the reconciliation of the ClusterSummary + instance itself, *excluding* errors related to the deployment of individual features. + type: string + featureSummaries: + description: |- + FeatureSummaries reports the status of each workload cluster feature + directly managed by ClusterProfile. + items: + description: |- + FeatureSummary contains a summary of the state of a workload + cluster feature. + properties: + consecutiveFailures: + description: The number of consecutive deployment failures. + type: integer + deployedGroupVersionKind: + description: |- + DeployedGroupVersionKind contains all GroupVersionKinds deployed in either + the workload cluster or the management cluster because of this feature. + Each element has format kind.version.group + + Deprecated: Replaced by FeatureDeploymentInfo field instead + items: + type: string + type: array + failureMessage: + description: FailureMessage provides more information about + the error. + type: string + failureReason: + description: FailureReason indicates the type of error that + occurred. + type: string + featureID: + description: FeatureID is an indentifier of the feature whose + status is reported + enum: + - Resources + - Helm + - Kustomize + type: string + hash: + description: |- + Hash represents of a unique value for a feature at a fixed point in + time + format: byte + type: string + lastAppliedTime: + description: LastAppliedTime is the time feature was last reconciled + format: date-time + type: string + resourceSummaryDeployed: + description: |- + ResourceSummaryDeployed tracks whether a ResourceSummary was deployed + to the managed cluster for drift detection. nil means unknown (upgrade + scenario); true means currently deployed; false means removed. + type: boolean + status: + description: Status represents the state of the feature in the + workload cluster + enum: + - Provisioning + - Provisioned + - Failed + - FailedNonRetriable + - Removing + - Removed + - AgentRemoving + type: string + required: + - featureID + type: object + type: array + x-kubernetes-list-map-keys: + - featureID + x-kubernetes-list-type: map + helmReleaseSummaries: + description: |- + HelmReleaseSummaries reports the status of each helm chart + directly managed by ClusterProfile. + items: + properties: + chartName: + description: |- + ChartName, RepositoryName, RepoURL, and ChartVersion mirror the fully resolved + (post-template) HelmChart entry that produced this release, captured at deploy time. + Never set for Flux-source-backed charts (Flux owns version resolution there). + type: string + chartVersion: + type: string + conflictMessage: + description: |- + Status indicates whether ClusterSummary can manage the helm + chart or there is a conflict + type: string + credentialsSecretRef: + description: |- + CredentialsSecretRef is the resolved secret reference (if any) used to authenticate + against RepoURL, captured at deploy time. Only the reference is stored, never secret + contents. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which the + secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + failureMessage: + description: FailureMessage provides the specific error from + the Helm engine for this release + type: string + lastCheckedTime: + description: LastCheckedTime is when LatestVersion/LatestPatchVersion + were last evaluated. + format: date-time + type: string + latestPatchVersion: + description: |- + LatestPatchVersion is the highest published version sharing ChartVersion's + major.minor, if greater than ChartVersion. Distinguishes "a same-minor patch bump is + available" from "a newer minor/major line exists" (LatestVersion). + type: string + latestVersion: + description: |- + LatestVersion is the highest version currently published upstream for this chart, if + greater than ChartVersion. Populated by a periodic background check, independent of + the reconcile loop. Detection only: Sveltos never mutates ChartVersion based on this. + type: string + patchesHash: + description: PatchesHash represents of a unique value for the + patches section + format: byte + type: string + releaseName: + description: ReleaseName is the chart release + minLength: 1 + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace release will + be installed + minLength: 1 + type: string + repoURL: + type: string + repositoryName: + type: string + status: + description: |- + Status indicates whether ClusterSummary can manage the helm + chart or there is a conflict + enum: + - Managing + - Conflict + type: string + valuesHash: + description: ValuesHash represents of a unique value for the + values section + format: byte + type: string + required: + - releaseName + - releaseNamespace + - status + type: object + type: array + x-kubernetes-list-type: atomic + nextReconcileTime: + description: |- + NextReconcileTime is the earliest time when this resource should be reconciled again. + Controller skips reconciliation if current time is before this timestamp. + If not set, reconciliations will happen as usual. + format: date-time + type: string + reconciliationSuspended: + description: |- + ReconciliationSuspended indicates whether the reconciliation loop for this + ClusterSummary is currently paused due to an external action (e.g., a user annotation). + When true, the status will not be updated unless the pause is lifted. + type: boolean + suspensionReason: + description: SuspensionReason provides a brief explanation of why + the reconciliation is suspended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +`) diff --git a/lib/crd/crd.go b/lib/crd/crd.go new file mode 100644 index 00000000..df729182 --- /dev/null +++ b/lib/crd/crd.go @@ -0,0 +1,43 @@ +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package crd + +//go:generate go run generator.go + +func GetClusterProfileCRDYAML() []byte { + return ClusterProfileCRD +} + +func GetProfileCRDYAML() []byte { + return ProfileCRD +} + +func GetClusterSummaryCRDYAML() []byte { + return ClusterSummaryCRD +} + +func GetClusterConfigurationCRDYAML() []byte { + return ClusterConfigurationCRD +} + +func GetClusterReportCRDYAML() []byte { + return ClusterReportCRD +} + +func GetClusterPromotionCRDYAML() []byte { + return ClusterPromotionCRD +} diff --git a/lib/crd/crd_suite_test.go b/lib/crd/crd_suite_test.go new file mode 100644 index 00000000..72b23828 --- /dev/null +++ b/lib/crd/crd_suite_test.go @@ -0,0 +1,29 @@ +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package crd_test + +import ( + "testing" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" +) + +func TestCrd(t *testing.T) { + RegisterFailHandler(Fail) + RunSpecs(t, "CRD Suite") +} diff --git a/lib/crd/crd_test.go b/lib/crd/crd_test.go new file mode 100644 index 00000000..aebf4f2c --- /dev/null +++ b/lib/crd/crd_test.go @@ -0,0 +1,82 @@ +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package crd_test + +import ( + "os" + + . "github.com/onsi/ginkgo/v2" + . "github.com/onsi/gomega" + + "github.com/projectsveltos/addon-controller/lib/crd" +) + +var _ = Describe("CRD", func() { + It("Gets the ClusterProfile CustomResourceDefinition", func() { + yaml := crd.GetClusterProfileCRDYAML() + + currentFile, err := os.ReadFile(crd.ClusterProfileFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) + + It("Gets the Profile CustomResourceDefinition", func() { + yaml := crd.GetProfileCRDYAML() + + currentFile, err := os.ReadFile(crd.ProfileFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) + + It("Gets the ClusterSummary CustomResourceDefinition", func() { + yaml := crd.GetClusterSummaryCRDYAML() + + currentFile, err := os.ReadFile(crd.ClusterSummaryFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) + + It("Gets the ClusterConfiguration CustomResourceDefinition", func() { + yaml := crd.GetClusterConfigurationCRDYAML() + + currentFile, err := os.ReadFile(crd.ClusterConfigurationFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) + + It("Gets the ClusterReport CustomResourceDefinition", func() { + yaml := crd.GetClusterReportCRDYAML() + + currentFile, err := os.ReadFile(crd.ClusterReportFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) + + It("Gets the ClusterPromotion CustomResourceDefinition", func() { + yaml := crd.GetClusterPromotionCRDYAML() + + currentFile, err := os.ReadFile(crd.ClusterPromotionFile) + Expect(err).To(BeNil()) + + Expect(string(yaml)).To(Equal(string(currentFile))) + }) +}) diff --git a/lib/crd/generator.go b/lib/crd/generator.go new file mode 100644 index 00000000..34254cb2 --- /dev/null +++ b/lib/crd/generator.go @@ -0,0 +1,114 @@ +//go:build ignore +// +build ignore + +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package main + +import ( + "os" + "path/filepath" + "strings" + "text/template" +) + +const ( + crdTemplate = `// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var {{ .ExportedVar }}File = {{ printf "%q" .File }} +var {{ .ExportedVar }}CRD = []byte({{- printf "%s" .CRD -}}) +` +) + +func generate(filename, outputFilename, crdName string) { + // Get CustomResourceDefinition file + fileAbs, err := filepath.Abs(filename) + if err != nil { + panic(err) + } + + content, err := os.ReadFile(fileAbs) + if err != nil { + panic(err) + } + // CRD descriptions can contain backticks (markdown code formatting), which a raw + // string literal cannot represent directly. Close the raw string, splice in a quoted + // backtick, then reopen the raw string. + escaped := strings.ReplaceAll(string(content), "`", "` + \"`\" + `") + contentStr := "`" + escaped + "`" + + // Find the output. + f, err := os.Create(outputFilename + ".go") + if err != nil { + panic(err) + } + defer f.Close() + + // Store file contents. + type Info struct { + CRD string + File string + ExportedVar string + } + mi := Info{ + CRD: contentStr, + File: filename, + ExportedVar: crdName, + } + + // Generate template. + crdTmpl := template.Must(template.New("crd-generate").Parse(crdTemplate)) + if err := crdTmpl.Execute(f, mi); err != nil { + panic(err) + } +} + +func main() { + clusterProfileFile := "../../config/crd/bases/config.projectsveltos.io_clusterprofiles.yaml" + generate(clusterProfileFile, "clusterprofiles", "ClusterProfile") + + profileFile := "../../config/crd/bases/config.projectsveltos.io_profiles.yaml" + generate(profileFile, "profiles", "Profile") + + clusterSummaryFile := "../../config/crd/bases/config.projectsveltos.io_clustersummaries.yaml" + generate(clusterSummaryFile, "clustersummaries", "ClusterSummary") + + clusterConfigurationFile := "../../config/crd/bases/config.projectsveltos.io_clusterconfigurations.yaml" + generate(clusterConfigurationFile, "clusterconfigurations", "ClusterConfiguration") + + clusterReportFile := "../../config/crd/bases/config.projectsveltos.io_clusterreports.yaml" + generate(clusterReportFile, "clusterreports", "ClusterReport") + + clusterPromotionFile := "../../config/crd/bases/config.projectsveltos.io_clusterpromotions.yaml" + generate(clusterPromotionFile, "clusterpromotions", "ClusterPromotion") +} diff --git a/lib/crd/profiles.go b/lib/crd/profiles.go new file mode 100644 index 00000000..20e3676d --- /dev/null +++ b/lib/crd/profiles.go @@ -0,0 +1,2378 @@ +// Generated by *go generate* - DO NOT EDIT +/* +Copyright 2026. projectsveltos.io. All rights reserved. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package crd + +var ProfileFile = "../../config/crd/bases/config.projectsveltos.io_profiles.yaml" +var ProfileCRD = []byte(`--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.21.0 + name: profiles.config.projectsveltos.io +spec: + group: config.projectsveltos.io + names: + kind: Profile + listKind: ProfileList + plural: profiles + singular: profile + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: Profile is the Schema for the profiles API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + clusterRefs: + description: ClusterRefs identifies clusters to associate to. + items: + description: ObjectReference contains enough information to let + you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + clusterSelector: + description: ClusterSelector identifies clusters to associate to. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + continueOnConflict: + default: false + description: |- + By default (when ContinueOnConflict is unset or set to false), Sveltos stops deployment after + encountering the first conflict (e.g., another ClusterProfile already deployed the resource). + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if conflicts are detected for previous resources. + type: boolean + continueOnError: + default: false + description: |- + By default (when ContinueOnError is unset or set to false), Sveltos stops deployment after + encountering the first error. + If set to true, Sveltos will attempt to deploy remaining resources in the ClusterProfile even + if errors are detected for previous resources. + type: boolean + dependsOn: + description: |- + DependsOn specifies a list of other profiles that this instance depends on. + A ClusterProfile can only depend on other ClusterProfiles, and a Profile can + only depend on other Profiles. + The add-ons and applications defined in this instance will not be deployed + until all add-ons and applications in the profiles listed as dependencies are deployed. + items: + type: string + type: array + driftExclusions: + description: |- + DriftExclusions is a list of configuration drift exclusions to be applied when syncMode is + set to ContinuousWithDriftDetection. Each exclusion specifies JSON6902 paths to ignore + when evaluating drift, optionally targeting specific resources and features. + items: + properties: + paths: + description: Paths is a slice of JSON6902 paths to exclude from + configuration drift evaluation. + items: + type: string + type: array + target: + description: Target points to the resources that the paths refers + to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + x-kubernetes-list-type: atomic + extraAnnotations: + additionalProperties: + type: string + description: |- + ExtraAnnotations: These annotations will be added by Sveltos to all Kubernetes resources + deployed in a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a annotation with a key present in + ` + "`" + `ExtraAnnotations` + "`" + `, the value from ` + "`" + `ExtraAnnotations` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + extraLabels: + additionalProperties: + type: string + description: |- + ExtraLabels: These labels will be added by Sveltos to all Kubernetes resources deployed in + a managed cluster based on this ClusterProfile/Profile instance. + **Important:** If a resource deployed by Sveltos already has a label with a key present in + ` + "`" + `ExtraLabels` + "`" + `, the value from ` + "`" + `ExtraLabels` + "`" + ` will override the existing value. + (Deprecated use Patches instead) + type: object + helmCharts: + description: Helm charts is a list of helm charts that need to be + deployed + items: + properties: + chartName: + description: |- + ChartName is the chart name + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + Must be defined otherwise. + type: string + chartVersion: + description: |- + ChartVersion is the chart version + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + helmChartAction: + default: Install + description: HelmChartAction is the action that will be taken + on the helm chart + enum: + - Install + - Uninstall + type: string + options: + description: Options allows to set flags which are used during + installation. + properties: + atomic: + default: false + description: |- + if set, the installation process deletes the installation/upgrades on failure. + The --wait flag will be set automatically if --atomic is used + Default to false + type: boolean + dependencyUpdate: + default: false + description: |- + update dependencies if they are missing before installing the chart + Default to false + type: boolean + description: + description: Description is the description of an helm operation + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install/upgrade/uninstall + Default to false + type: boolean + disableOpenAPIValidation: + default: false + description: |- + if set, the installation process will not validate rendered templates against the Kubernetes OpenAPI Schema + Default to false + type: boolean + enableClientCache: + default: false + description: EnableClientCache is a flag to enable Helm + client cache. If it is not specified, it will be set to + false. + type: boolean + installOptions: + description: HelmInstallOptions are options specific to + helm install + properties: + createNamespace: + default: true + description: Create the release namespace if not present. + Defaults to true + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on install + Default to false + type: boolean + replace: + default: true + description: Replaces if set indicates to replace an + older release with this one + type: boolean + takeOwnership: + default: false + description: |- + if set, install will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Labels that would be added to release metadata. + type: object + passCredentialsAll: + description: PassCredentialsAll is the flag to pass credentials + to all domains + type: boolean + postRenderStrategy: + description: |- + PostRenderStrategy controls whether Helm hooks are included when Patches/PatchesFrom + are applied as a post-renderer during this chart's install/upgrade. Only relevant + when Patches or PatchesFrom is set on the Spec; ignored otherwise. Defaults to + Helm's own default (combined) when unset. + enum: + - combined + - separate + - nohooks + type: string + runTests: + default: false + description: |- + RunTests if set to true, Sveltos will run helm test after each successful install or upgrade + operation. The tests are the test hooks defined in the chart (annotated with + "helm.sh/hook: test"). If any test fails the deployment is considered failed and the + error is surfaced in the ClusterSummary status, providing operational gating. + Has no effect in DryRun mode. + Default to false + type: boolean + skipCRDs: + default: false + description: |- + SkipCRDs controls whether CRDs should be installed during install/upgrade operation. + By default, CRDs are installed if not already present. + type: boolean + skipSchemaValidation: + default: false + description: SkipSchemaValidation determines if JSON schema + validation is disabled. + type: boolean + timeout: + description: time to wait for any individual Kubernetes + operation (like Jobs for hooks) (default 5m0s) + type: string + uninstallOptions: + description: HelmUninstallOptions are options specific to + helm uninstall + properties: + deletionPropagation: + description: DeletionPropagation + enum: + - orphan + - foreground + - background + type: string + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on uninstall + Default to false + type: boolean + keepHistory: + description: |- + When uninstall a chart with this flag, Helm removes the resources associated with the chart, + but it keeps the release information. This allows to see details about the uninstalled release + using the helm history command. + type: boolean + type: object + upgradeOptions: + description: HelmUpgradeOptions are options specific to + helm upgrade + properties: + cleanupOnFail: + default: false + description: CleanupOnFail will, if true, cause the + upgrade to delete newly-created resources on a failed + update. + type: boolean + disableHooks: + default: false + description: |- + prevent hooks from running during install. If set to true, overrides + DisableHooks in HelmOptions. Use this one when you want to selective + disable hooks on upgrade + Default to false + type: boolean + force: + default: false + description: |- + Force will, if set to ` + "`" + `true` + "`" + `, ignore certain warnings and perform the upgrade anyway. + This should be used with caution. + type: boolean + maxHistory: + default: 2 + description: |- + MaxHistory limits the maximum number of revisions saved per release + Default to 2 + type: integer + recreate: + default: false + description: |- + Recreate will (if true) recreate pods after a rollback. + + Deprecated: This field is no longer supported + type: boolean + resetThenReuseValues: + default: false + description: ResetThenReuseValues will reset the values + to the chart's built-ins then merge with user's last + supplied values. + type: boolean + resetValues: + default: false + description: ResetValues will reset the values to the + chart's built-ins rather than merging with existing. + type: boolean + reuseValues: + default: false + description: |- + ReuseValues copies values from the current release to a new release if the + new release does not have any values. If the request already has values, + or if there are no values in the current release, this does nothing. + This is skipped if the ResetValues flag is set, in which case the + request values are not altered. + type: boolean + subNotes: + default: false + description: SubNotes determines whether sub-notes are + rendered in the chart. + type: boolean + takeOwnership: + default: false + description: |- + if set, upgrade will ignore the check for helm annotations + and take ownership of the existing resources + type: boolean + upgradeCRDs: + default: false + description: |- + UpgradeCRDs upgrade CRDs from the Helm Chart's crds directory + By default, CRDs are not applied during Helm upgrade action by Helm + https://helm.sh/docs/chart_best_practices/custom_resource_definitions/ + type: boolean + type: object + wait: + default: false + description: |- + if set, will wait until all Pods, PVCs, Services, and minimum number of Pods of a Deployment, StatefulSet, or ReplicaSet + are in a ready state before marking the release as successful. It will wait for as long as --timeout + Default to false + type: boolean + waitForJobs: + default: false + description: |- + if set and --wait enabled, will wait until all Jobs have been completed before marking the release as successful. + It will wait for as long as --timeout + Default to false + type: boolean + type: object + provenanceVerification: + description: |- + ProvenanceVerification configures Helm GPG .prov file verification for HTTP chart repositories. + Ignored for OCI and Flux-sourced charts. + properties: + keyringSecretRef: + description: |- + KeyringSecretRef references a Secret in the management cluster containing the GPG keyring. + The Secret must have a key named "keyring.gpg". + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - keyringSecretRef + type: object + registryCredentialsConfig: + description: |- + RegistryCredentialsConfig is an optional configuration for credentials, + including information to connect to private registries. + properties: + ca: + description: |- + CASecretRef references a secret containing the TLS CA certificate + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + key: ca.crt + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + credentials: + description: |- + CredentialsSecretRef references a secret containing credentials + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + insecureSkipTLSVerify: + description: InsecureSkipTLSVerify controls server certificate + verification. + type: boolean + key: + description: |- + Key specifies the key within the CredentialsSecretRef containing the data + If not specified, it defaults to the only key in the secret if there's just one. + type: string + plainHTTP: + description: PlainHTTP indicates to use insecure HTTP connections + for the chart download + type: boolean + type: object + releaseName: + description: ReleaseName is the chart release + minLength: 1 + type: string + releaseNamespace: + description: ReleaseNamespace is the namespace release will + be installed + minLength: 1 + type: string + repositoryName: + description: |- + RepositoryName is the name helm chart repository + This field is used only when RepositoryURL points to a traditional HTTP or OCI repository. + It is ignored if RepositoryURL references a Flux Source. + Must be defined otherwise. + type: string + repositoryURL: + description: |- + RepositoryURL is the URL helm chart repository + It can point to a traditional HTTP-based repository or an OCI registry. + Examples: + - HTTP Repository: https://charts.example.com/stable + - OCI Registry: oci://registry.example.com/namespace/charts + - GitHub Pages: https://.github.io// + - Any other valid URL where Helm charts are hosted. + + Alternatively, it can be a Flux source reference: + ://// + + Where: + - is the type of Flux source (gitrepository, ocirepository, bucket). + - and are the namespace and name of the Flux Source in the management cluster. + - is the path within the source repository where the Helm charts are located. + + For instance: + gitrepository://flux-system/flux-system/charts/projectsveltos + + Assuming there is a Flux GitRepository named 'flux-system' in the 'flux-system' namespace + syncing 'https://github.com/projectsveltos/helm-charts.git/', and the Helm charts are + located in the 'charts/projectsveltos' directory of that repository. + minLength: 1 + type: string + signatureVerification: + description: |- + SignatureVerification configures Cosign-based signature verification for OCI Helm charts. + Ignored when RepositoryURL does not start with "oci://". + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity lists OIDC identity matchers for keyless verification. + At least one matcher must be satisfied. Required when Provider is Keyless. + items: + description: OIDCIdentityMatcher specifies the expected + OIDC issuer and subject for keyless Cosign verification. + properties: + issuer: + description: Issuer is the OIDC issuer URL or regex. + minLength: 1 + type: string + subject: + description: Subject is the OIDC subject or regex, + typically the workload identity or GitHub Actions + workflow URL. + minLength: 1 + type: string + required: + - issuer + - subject + type: object + type: array + provider: + description: Provider specifies how to obtain the verification + key or certificate. + enum: + - PublicKey + - Keyless + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing the Cosign public key. + The Secret must have a key named "cosign.pub" holding a PEM-encoded public key. + Required when Provider is PublicKey. + If Namespace is omitted, the cluster's namespace is used. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - provider + type: object + values: + description: |- + Values field allows to define configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store configuration for the Helm release. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + required: + - releaseName + - releaseNamespace + - repositoryURL + type: object + x-kubernetes-validations: + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartName) + >= 1 : true' + - message: ChartName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartName) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.chartVersion) + >= 1 : true' + - message: ChartVersion must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.chartVersion) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''http'') ? size(self.repositoryName) + >= 1 : true' + - message: RepositoryName must be defined + rule: 'self.repositoryURL.startsWith(''oci'') ? size(self.repositoryName) + >= 1 : true' + type: array + x-kubernetes-list-type: atomic + kustomizationRefs: + description: |- + Kustomization refs is a list of kustomization paths. Kustomization will + be run on those paths and the outcome will be deployed. + items: + properties: + components: + description: |- + Components is a list of paths to Kustomize components. These paths are relative to the + ` + "`" + `Path` + "`" + ` field and are included in the Kustomize build to provide reusable configuration logic. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + type: string + type: array + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + NOTE: DeploymentType Local cannot be used when the matching cluster is the management cluster itself. + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + KustomizationRef when an update is rejected with an error that only a delete+recreate + can resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - flux GitRepository;OCIRepository;Bucket + - ConfigMap/Secret + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS + endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket + or a ConfigMap/Secret. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the remote source serving the Kustomize directory content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball + (.tar.gz) of the Kustomize directory + "oci://" — OCI registry artifact whose layers are extracted + the same way, preserving the directory tree + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this KustomizationRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different KustomizationRef + within the same ClusterProfile or Profile. + When two KustomizationRef attempt to deploy the same resource, the KustomizationRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + values: + additionalProperties: + type: string + description: |- + Values is a map[string]string type that allows to define a set of key-value pairs. + These key-value pairs can optionally leverage Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + type: object + valuesFrom: + description: |- + ValuesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to define key-value pairs. These key-value pairs can optionally leverage + Go templates for further processing. + With Sveltos, you can define key-value pairs where the values can be Go templates. + These templates have access to management cluster information during deployment. This allows + to do more than just replace placeholders. Variables can be used to dynamically + construct values based on other resources or variables within the Kustomize output. + For example, imagine you have a Region key with a template value like: + '{{ index .Cluster.metadata.labels "region" }}'. + This template retrieves the region label from the cluster instance metadata. + Finally, Sveltos uses these processed values to fill placeholders in the Kustomize output. + The output itself can also contain templates, like: + region: '{{ default "west" .Region }}'. + This way, the final output from Kustomize will have the region set dynamically based on + the actual region retrieved earlier. + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + maxConsecutiveFailures: + description: |- + The maximum number of consecutive deployment failures that Sveltos will permit. + After this many consecutive failures, the deployment will be considered failed, and Sveltos will stop retrying. + This setting applies only to feature deployments, not resource removal. + This field is optional. If not set, Sveltos default behavior is to keep retrying. + type: integer + maxUpdate: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of clusters that can be updated concurrently. + Value can be an absolute number (ex: 5) or a percentage of desired cluster (ex: 10%). + Defaults to 100%. + Example: when this is set to 30%, when list of add-ons/applications in ClusterProfile + changes, only 30% of matching clusters will be updated in parallel. Only when updates + in those cluster succeed, other matching clusters are updated. + pattern: ^((100|[0-9]{1,2})%|[0-9]+)$ + x-kubernetes-int-or-string: true + patches: + description: |- + Define additional Kustomize inline Patches applied for all resources on this profile + Within the Patch Spec you can use templating + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + x-kubernetes-list-type: atomic + patchesFrom: + description: |- + PatchesFrom can reference ConfigMap/Secret instances. Within the ConfigMap or Secret data, + it is possible to store additional Kustomize inline Patches applied for all resources on this profile + These values can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + enum: + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. The Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other ValueFroms. + type: boolean + required: + - kind + - name + type: object + type: array + x-kubernetes-list-type: atomic + policyRefs: + description: |- + PolicyRefs references all the ConfigMaps/Secrets/Flux Sources containing kubernetes resources + that need to be deployed in the matching managed clusters. + The values contained in those resources can be static or leverage Go templates for dynamic customization. + When expressed as templates, the values are filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + items: + properties: + deploymentType: + default: Remote + description: |- + DeploymentType indicates whether resources need to be deployed + into the management cluster (local) or the managed cluster (remote) + enum: + - Local + - Remote + type: string + force: + default: false + description: |- + Force indicates whether Sveltos should delete and recreate a resource defined in this + PolicyRef when an update is rejected with an error that only a delete+recreate can + resolve (eg an invalid combination of fields, or a field enforced as immutable). + By default, such errors are surfaced instead of recreating the resource. + type: boolean + kind: + description: |- + Kind of the resource. Supported kinds are: + - ConfigMap/Secret + - flux GitRepository;OCIRepository;Bucket + Required when RemoteURL is not set. + enum: + - GitRepository + - OCIRepository + - Bucket + - ConfigMap + - Secret + type: string + name: + description: |- + Name of the referenced resource. + Name can be expressed as a template and instantiate using any cluster field. + Required when RemoteURL is not set. + type: string + namespace: + description: |- + Namespace of the referenced resource. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + For Profile namespace must be left empty. Profile namespace will be used. + Namespace can be expressed as a template and instantiate using any cluster field. + Not used when RemoteURL is set. + type: string + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other PolicyRefs. + type: boolean + path: + description: |- + Path to the directory containing the YAML files. + Defaults to 'None', which translates to the root path of the SourceRef. + Used only for GitRepository;OCIRepository;Bucket + This value can be static or leverage Go templates for dynamic customization. + When expressed as a template, it is filled in using information from + resources within the management cluster before deployment (Cluster and TemplateResourceRefs) + type: string + remoteURL: + description: |- + RemoteURL configures fetching content from an HTTP/HTTPS endpoint or an OCI registry. + When set, Kind/Name/Namespace must be omitted. + properties: + interval: + description: |- + Interval defines how often Sveltos re-fetches the source to detect changes. + Defaults to 5 minutes. + type: string + secretRef: + description: |- + SecretRef references a Secret in the management cluster containing optional + credentials for fetching the source. Both Name and Namespace must be set, + allowing the Secret to live in any namespace (e.g. projectsveltos) so that + a single Secret can be shared across clusters without replication. + Supported Secret keys: + "token" — Bearer token (Authorization: Bearer ) + "username"+"password" — HTTP Basic Auth or OCI registry basic auth + "caFile" — PEM-encoded CA certificate for TLS verification + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: |- + Template indicates that the fetched content is a Go template that + must be instantiated using cluster fields and templateResourceRefs values + before deployment. Equivalent to the projectsveltos.io/template annotation + on a ConfigMap or Secret. + type: boolean + url: + description: |- + URL is the remote source serving raw YAML/JSON content. + Sveltos fetches the content on every reconciliation and redeploys if the + content hash has changed. + Supported schemes: + "http://" or "https://" — HTTP/HTTPS endpoint returning raw YAML/JSON + "oci://" — OCI registry artifact containing YAML manifests + pattern: ^(https?|oci):// + type: string + required: + - url + type: object + skipNamespaceCreation: + default: false + description: |- + SkipNamespaceCreation indicates whether Sveltos should skip creating the namespace + for namespaced resources defined in this PolicyRef. + This field is ignored for cluster-scoped resources. + By default, Sveltos attempts to get or create the target namespace if it does not exist. + Setting this to true avoids those calls, which is necessary when Sveltos lacks + permissions to manage namespaces at the cluster level. + type: boolean + tier: + default: 100 + description: |- + Tier controls the order of deployment for resources coming from different PolicyRefs + within the same ClusterProfile or Profile. + When two PolicyRefs attempt to deploy the same resource, the PolicyRef with the lowest + Tier value takes priority and deploys/updates the resource. + This priority mechanism is only checked after the parent ClusterProfile has won + the primary conflict resolution against other ClusterProfiles. + Higher Tier values represent lower priority. The default Tier value is 100. + format: int32 + minimum: 1 + type: integer + type: object + x-kubernetes-validations: + - message: either remoteURL or kind must be set, but not both + rule: has(self.remoteURL) != has(self.kind) + type: array + x-kubernetes-list-type: atomic + postDeleteChecks: + description: |- + PostDeleteChecks is a slice of checks to run against the managed cluster + *after* Sveltos has deleted all resources. + This ensures that the environment has reached the desired clean state. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeleteChecks: + description: |- + PreDeleteChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deleting resources. + If any of these fail, the deletion process is halted. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + preDeployChecks: + description: |- + PreDeployChecks is a slice of checks to run against the managed cluster + *before* Sveltos starts deploying resources. + Each check can use Lua scripts or CEL expressions to validate the cluster state. + If any check fails, the deployment of the associated feature is halted. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + reloader: + default: false + description: |- + Reloader indicates whether Deployment/StatefulSet/DaemonSet instances deployed + by Sveltos and part of this ClusterProfile need to be restarted via rolling upgrade + when a ConfigMap/Secret instance mounted as volume is modified. + When set to true, when any mounted ConfigMap/Secret is modified, Sveltos automatically + starts a rolling upgrade for Deployment/StatefulSet/DaemonSet instances mounting it. + type: boolean + setRefs: + description: |- + SetRefs identifies referenced (cluster)Sets. + - ClusterProfile can reference ClusterSet; + - Profile can reference Set; + items: + type: string + type: array + stopMatchingBehavior: + default: WithdrawPolicies + description: |- + StopMatchingBehavior indicates what behavior should be when a Cluster stop matching + the ClusterProfile. By default all deployed Helm charts and Kubernetes resources will + be withdrawn from Cluster. Setting StopMatchingBehavior to LeavePolicies will instead + leave ClusterProfile deployed policies in the Cluster. + enum: + - WithdrawPolicies + - LeavePolicies + type: string + syncMode: + default: Continuous + description: |- + SyncMode specifies how features are synced in a matching workload cluster. + - OneTime means, first time a workload cluster matches the ClusterProfile, + features will be deployed in such cluster. Any subsequent feature configuration + change won't be applied into the matching workload clusters; + - Continuous mode ensures that the first time a workload cluster matches a ClusterProfile, + the specified features are deployed. Subsequent changes to the feature configuration are also + automatically applied to all matching workload clusters. + _ SyncModeContinuousWithDriftDetection operates similarly to Continuous mode, but also monitors + matching managed clusters for configuration drift. If drift is detected, a reconciliation is + triggered to ensure the managed cluster's configuration aligns with the ClusterProfile. + - DryRun means no change will be propagated to any matching cluster. A report + instead will be generated summarizing what would happen in any matching cluster + because of the changes made to ClusterProfile while in DryRun mode. + enum: + - OneTime + - Continuous + - ContinuousWithDriftDetection + - DryRun + type: string + templateResourceRefs: + description: |- + TemplateResourceRefs is a list of resource to collect from the management cluster. + Those resources' values will be used to instantiate templates + items: + properties: + identifier: + description: |- + Identifier is how the resource will be referred to in the + template + type: string + ignoreStatusChanges: + default: false + description: |- + IgnoreStatusChanges indicates whether changes to the status of the referenced + resource should be ignored. If set to true, only changes to the spec or + metadata (generation change) will trigger a reconciliation. + type: boolean + optional: + default: false + description: |- + Optional indicates that the referenced resource is not mandatory. + If set to true and the resource is not found, the error will be ignored, + and Sveltos will continue processing other TemplateResourceRefs. + type: boolean + resource: + description: |- + Resource references a Kubernetes instance in the management + cluster to fetch and use during template instantiation. + For ClusterProfile namespace can be left empty. In such a case, namespace will + be implicit set to cluster's namespace. + Name and namespace can be expressed as a template and instantiate using any cluster field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + watchFields: + description: |- + WatchFields is an optional list of dot-separated field paths to include + when computing the hash for this resource (e.g. "status.readyReplicas", + "metadata.labels"). When non-empty, only the listed fields are hashed and + IgnoreStatusChanges is ignored. Use this when you need to react to a + specific field without being sensitive to every other change on the object. + items: + type: string + type: array + required: + - identifier + - resource + type: object + type: array + x-kubernetes-list-map-keys: + - identifier + x-kubernetes-list-type: map + tier: + default: 100 + description: |- + Tier controls the order of deployment for ClusterProfile or Profile resources targeting + the same cluster resources. + Imagine two configurations (ClusterProfiles or Profiles) trying to deploy the same resource (a Kubernetes + resource or an helm chart). By default, the first one to reach the cluster "wins" and deploys it. + Tier allows you to override this. When conflicts arise, the ClusterProfile or Profile with the **lowest** + Tier value takes priority and deploys the resource. + Higher Tier values represent lower priority. The default Tier value is 100. + Using Tiers provides finer control over resource deployment within your cluster, particularly useful + when multiple configurations manage the same resources. + format: int32 + minimum: 1 + type: integer + validateHealths: + description: |- + ValidateHealths is a slice of checks to run against the managed cluster + *after* resources are deployed to validate that the state of the + add-ons/applications is healthy. + Each check can select resources and validate them using Lua scripts or CEL expressions. + items: + properties: + evaluateCEL: + description: |- + EvaluateCEL contains a list of named CEL (Common Expression Language) rules. + Each rule will be evaluated in order against each object selected based on + the criteria defined above. Each rule's expression must return a boolean value + indicating whether the object is a match. + + Evaluation stops at the first rule that returns true; subsequent + rules will not be evaluated. + items: + description: CELRule defines a named CEL rule used in EvaluateCEL. + properties: + name: + description: Name is a human-readable identifier for the + rule. + type: string + rule: + description: |- + Rule is the CEL (Common Expression Language) expression to evaluate. + It must return a bool + type: string + required: + - name + - rule + type: object + type: array + featureID: + description: |- + FeatureID is an indentifier of the feature (Helm/Kustomize/Resources) + This field indicates when to run this check. + For instance: + - if set to Helm this check will be run after all helm + charts specified in the ClusterProfile are deployed. + - if set to Resources this check will be run after the content + of all the ConfigMaps/Secrets referenced by ClusterProfile in the + PolicyRef sections is deployed + enum: + - Resources + - Helm + - Kustomize + type: string + group: + description: |- + Group of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + kind: + description: |- + Kind of the resource to fetch in the managed Cluster. + Leave empty for metric-only checks. + type: string + labelFilters: + description: LabelFilters allows to filter resources based on + current labels. + items: + properties: + key: + description: Key is the label key + type: string + operation: + description: Operation is the comparison operation + enum: + - Equal + - Different + - Has + - DoesNotHave + type: string + value: + description: Value is the label value + type: string + required: + - key + - operation + type: object + type: array + metricQueries: + description: |- + MetricQueries lists the PromQL instant queries to execute against + MetricSource. Results are injected into the evaluation script as a + "metrics" map keyed by each query's Name field, value is the scalar + float result. Scripts access results via metrics[""]. + items: + description: |- + MetricQuery binds a PromQL instant-query result to a name the evaluation + script can reference via the metrics table (e.g. metrics["errorRate"]). + properties: + name: + description: |- + Name is the key under which the scalar result is available in the script. + Must be unique within the ValidateHealth entry. + minLength: 1 + type: string + query: + description: Query is a PromQL instant-query expression. + minLength: 1 + type: string + required: + - name + - query + type: object + type: array + metricSource: + description: |- + MetricSource identifies the Prometheus-compatible endpoint to query. + Required when MetricQueries is set. + properties: + path: + description: |- + Path is the HTTP path for Prometheus instant queries. + Defaults to /api/v1/query when empty. + type: string + secretRef: + description: |- + SecretRef optionally references a Secret on the managed cluster containing + credentials to authenticate against the endpoint. + The Secret namespace and name must both be specified. + Supported keys: "token" (bearer token), "username" and "password" (basic auth). + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL is the base HTTP(S) address of the Prometheus-compatible endpoint + (e.g. http://prometheus.monitoring.svc:9090). + minLength: 1 + type: string + required: + - url + type: object + name: + description: Name is the name of this check + type: string + namespace: + description: |- + Namespace of the resource to fetch in the managed Cluster. + Empty for resources scoped at cluster level. + type: string + script: + description: |- + Script is a text containing a lua script. + Must return struct with field "health" + representing whether object is a match (true or false) + type: string + version: + description: |- + Version of the resource to fetch in the managed Cluster. + Required when Kind is set. Leave empty for metric-only checks. + type: string + required: + - featureID + - name + type: object + type: array + x-kubernetes-list-type: atomic + type: object + status: + description: Status defines the observed state of ClusterProfile/Profile + properties: + dependenciesHash: + description: |- + DependenciesHash is a hash representing the set of clusters where this ClusterProfile + must be deployed, based on the combined configuration of its dependencies. + format: byte + type: string + failedClusters: + description: |- + FailedClusters contains information about clusters for which + a ClusterSummary could not be created or updated. + items: + description: |- + FailedCluster describes an error encountered while trying to + manage resources for a specific matching cluster. + properties: + clusterRef: + description: ClusterRef is a reference to the cluster where + the failure occurred. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + failureMessage: + description: |- + FailureMessage is a human-readable explanation of why the + ClusterSummary creation/update failed. + type: string + lastFailureTime: + description: LastFailureTime is the time the error occurred. + format: date-time + type: string + required: + - clusterRef + - failureMessage + type: object + type: array + matchingClusters: + description: |- + MatchingClusterRefs reference all the clusters currently matching + ClusterProfile ClusterSelector + items: + description: ObjectReference contains enough information to let + you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + reconciliationSuspended: + description: |- + ReconciliationSuspended indicates whether the reconciliation loop for this + ClusterSummary is currently paused due to an external action (e.g., a user annotation). + When true, the status will not be updated unless the pause is lifted. + type: boolean + suspensionReason: + description: SuspensionReason provides a brief explanation of why + the reconciliation is suspended. + type: string + updatedClusters: + description: |- + UpdatedClusters contains information all the cluster currently matching + ClusterProfile ClusterSelector and already updated to latest ClusterProfile + Spec + properties: + clusters: + description: |- + Clusters reference all the clusters currently matching + ClusterProfile ClusterSelector and already updated/being updated + to ClusterProfile Spec + items: + description: ObjectReference contains enough information to + let you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + hash: + description: |- + Hash represents of a unique value for ClusterProfile Spec at + a fixed point in time + format: byte + type: string + type: object + updatingClusters: + description: |- + UpdatingClusters reference all the cluster currently matching + ClusterProfile ClusterSelector and being updated + properties: + clusters: + description: |- + Clusters reference all the clusters currently matching + ClusterProfile ClusterSelector and already updated/being updated + to ClusterProfile Spec + items: + description: ObjectReference contains enough information to + let you inspect or modify the referred object. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + hash: + description: |- + Hash represents of a unique value for ClusterProfile Spec at + a fixed point in time + format: byte + type: string + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +`)