diff --git a/README.md b/README.md index 94900c9..6f32401 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,10 @@ > [docs/architecture/gitops-layering.md](docs/architecture/gitops-layering.md#current-state--todo). The apps running on the Syscode homelab Kubernetes clusters, and their config. -Argo CD (self-managed, one instance per cluster) watches this repo and applies -changes automatically — no manual `kubectl apply`. +Argo CD (self-managed, hosted in `unraid-lab`) watches this repo and applies +changes automatically — no manual `kubectl apply`. It also reconciles +`oci-lab` remotely through a registered external cluster; `oci-lab` runs no +Argo CD of its own. ## Apps diff --git a/appset.yaml b/appset.yaml index 7324504..e7a9cb4 100644 --- a/appset.yaml +++ b/appset.yaml @@ -1,9 +1,11 @@ # Layering ApplicationSet — the "chart-app" engine. # -# SEEDED PER CLUSTER by the Talos inline manifests. The two `list` elements below -# (clusterName / clusterType) are the ONLY per-cluster difference — each cluster's -# inline manifest embeds this file with its own identity. This copy is the -# canonical reference; the identities here are placeholders. +# ONE instance, hosted in unraid-lab's Argo CD (embedded via unraid-lab's Talos +# inline manifests). It covers BOTH clusters: oci-lab is reconciled remotely +# through the registered external cluster — oci-lab deliberately runs no local +# Argo CD. Application destinations differ per element (see the conditional in +# `destination` below): in-cluster server for unraid-lab, registered cluster +# name `oci-lab` for OCI. # # Selection (which apps run): three git generators — # apps/*/app.yaml shared (every cluster) @@ -26,8 +28,14 @@ spec: generators: - list: elements: - - clusterName: CLUSTER_NAME - clusterType: CLUSTER_TYPE + - clusterName: unraid-lab + clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -37,8 +45,14 @@ spec: generators: - list: elements: - - clusterName: CLUSTER_NAME - clusterType: CLUSTER_TYPE + - clusterName: unraid-lab + clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -48,8 +62,14 @@ spec: generators: - list: elements: - - clusterName: CLUSTER_NAME - clusterType: CLUSTER_TYPE + - clusterName: unraid-lab + clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -74,7 +94,15 @@ spec: targetRevision: HEAD ref: v destination: - server: https://kubernetes.default.svc + # oci-lab has no in-cluster Argo: target the registered external + # cluster by name. Its Secret lives in unraid-lab's argocd namespace + # (clusters/unraid-lab/apps/oci-cluster-registration). Exactly one of + # name/server is set per element — Argo resolves by name when server + # is empty, by server when name is empty. The fields stay pure YAML: + # ApplicationSet templates render AFTER YAML parsing, so conditional + # KEYS are not possible here; per-element params keep it parseable. + name: "{{ .destinationName }}" + server: "{{ .destinationServer }}" namespace: "{{.namespace}}" syncPolicy: automated: diff --git a/clusters/oci-lab/apps/oci-pivot-secrets/application.yaml b/clusters/oci-lab/apps/oci-pivot-secrets/application.yaml index 22aa966..723727f 100644 --- a/clusters/oci-lab/apps/oci-pivot-secrets/application.yaml +++ b/clusters/oci-lab/apps/oci-pivot-secrets/application.yaml @@ -3,6 +3,9 @@ # until the owner delivers the bw-auth-token Secret + fills in # organizationId/projectId/bwSecretId — see add-external-secrets-bitwarden # (syscode-ai-internal-plans). +# +# Applied by unraid-lab's Argo (oci-raw lane) to the registered oci-lab +# cluster — oci-lab runs no local Argo CD. apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -15,7 +18,7 @@ spec: targetRevision: HEAD path: clusters/oci-lab/apps/oci-pivot-secrets/manifests destination: - server: https://kubernetes.default.svc + name: oci-lab namespace: oci-pivot-system syncPolicy: automated: diff --git a/clusters/unraid-lab/apps/oci-bootstrap/application.yaml b/clusters/unraid-lab/apps/oci-bootstrap/application.yaml new file mode 100644 index 0000000..15e3d5e --- /dev/null +++ b/clusters/unraid-lab/apps/oci-bootstrap/application.yaml @@ -0,0 +1,26 @@ +# unraid-lab-only. Syncs bootstrap/ to the oci-lab EXTERNAL cluster — +# but ONLY the Tailscale bits. bootstrap/argocd-cm.yaml and +# bootstrap/argocd-rbac-cm.yaml configure unraid's LOCAL Argo CD +# (PocketID URL, RBAC) and must not land on oci-lab, which runs no Argo. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: oci-bootstrap + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git + targetRevision: HEAD + path: bootstrap + directory: + include: "tailscale-*.yaml" + destination: + name: oci-lab + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/clusters/unraid-lab/apps/oci-cluster-registration/application.yaml b/clusters/unraid-lab/apps/oci-cluster-registration/application.yaml new file mode 100644 index 0000000..62d699e --- /dev/null +++ b/clusters/unraid-lab/apps/oci-cluster-registration/application.yaml @@ -0,0 +1,24 @@ +# unraid-lab-only. Argo CD on unraid-lab reconciles the oci-lab external +# cluster (see oci-cluster-registration). This Application ships the +# cluster-registration ExternalSecret into unraid's Argo CD — it is a +# plain raw manifest, not a chart-app. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: oci-cluster-registration + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git + targetRevision: HEAD + path: clusters/unraid-lab/apps/oci-cluster-registration/manifests + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/clusters/unraid-lab/apps/oci-cluster-registration/manifests/external-secret.yaml b/clusters/unraid-lab/apps/oci-cluster-registration/manifests/external-secret.yaml new file mode 100644 index 0000000..87c1668 --- /dev/null +++ b/clusters/unraid-lab/apps/oci-cluster-registration/manifests/external-secret.yaml @@ -0,0 +1,50 @@ +# Registers the oci-lab external cluster with unraid-lab's Argo CD. +# +# oci-lab runs NO local Argo CD; this Secret is what lets unraid's Argo +# reconcile it (ApplicationSet destination `name: oci-lab`, oci-raw / +# oci-bootstrap lanes). Endpoint is the PRIVATE API address — +# https://:6443 — reachable only over +# tailnet → wrt-london → IPSec → the OCI vpn subnet. +# +# The bearer token authenticates as ServiceAccount argocd-manager +# (kube-system on oci-lab, created by the argocd-manager inline manifest). +# It is a long-lived service-account token (Secret of type +# kubernetes.io/service-account-token annotated with that SA), generated +# POST-bootstrap and stored in Bitwarden — never committed. Stays unhealthy +# until Bitwarden contains the separate server, CA (base64 TLS CA of the +# oci-lab API server), and token secrets referenced below. +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: oci-lab-cluster + namespace: argocd +spec: + refreshInterval: 1h + secretStoreRef: + name: bitwarden + kind: ClusterSecretStore + target: + name: oci-lab-cluster + creationPolicy: Owner + deletionPolicy: Retain + template: + metadata: + labels: + # Makes unraid-lab's Argo CD treat this Secret as a cluster registration. + argocd.argoproj.io/secret-type: cluster + type: Opaque + data: + name: oci-lab + server: "{{ .server }}" + config: | + {"tlsClientConfig": {"insecure": false, "caData": "{{ .ca }}", "bearerToken": "{{ .token }}"}} + data: + - secretKey: server + remoteRef: + key: "817bc3d5-0e06-4bea-abfb-b4b600a39165" # gitleaks:allow -- Bitwarden secret UUID, not a credential + - secretKey: ca + remoteRef: + key: "979fe9de-2c24-4806-8402-b4b600a3919d" # gitleaks:allow -- Bitwarden secret UUID, not a credential + - secretKey: token + remoteRef: + key: "f42aff26-639b-454a-a6d6-b4b600a391d8" # gitleaks:allow -- Bitwarden secret UUID, not a credential diff --git a/clusters/unraid-lab/apps/oci-raw/application.yaml b/clusters/unraid-lab/apps/oci-raw/application.yaml new file mode 100644 index 0000000..e2fe31d --- /dev/null +++ b/clusters/unraid-lab/apps/oci-raw/application.yaml @@ -0,0 +1,27 @@ +# unraid-lab-only. Raw-manifest lane for the oci-lab EXTERNAL cluster: +# plain-manifest apps that aren't a chart-app (e.g. cert-manager +# Issuer/Certificate, oci-pivot-secrets) applied to oci-lab by unraid's +# Argo CD. Mirrors argocd-unraid-raw — oci-lab runs no local Argo CD. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: oci-raw + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git + targetRevision: HEAD + path: clusters/oci-lab/apps + directory: + recurse: true + include: "*/application.yaml" + destination: + name: oci-lab + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/clusters/unraid-lab/omni/inline-manifests.yaml b/clusters/unraid-lab/omni/inline-manifests.yaml index 0acbae2..2ed45ed 100644 --- a/clusters/unraid-lab/omni/inline-manifests.yaml +++ b/clusters/unraid-lab/omni/inline-manifests.yaml @@ -34186,10 +34186,12 @@ cluster: contents: | # Layering ApplicationSet — the "chart-app" engine. # - # SEEDED PER CLUSTER by the Talos inline manifests. The two `list` elements below - # (clusterName / clusterType) are the ONLY per-cluster difference — each cluster's - # inline manifest embeds this file with its own identity. This copy is the - # canonical reference; the identities here are placeholders. + # ONE instance, hosted in unraid-lab's Argo CD (embedded via unraid-lab's Talos + # inline manifests). It covers BOTH clusters: oci-lab is reconciled remotely + # through the registered external cluster — oci-lab deliberately runs no local + # Argo CD. Application destinations differ per element (see the conditional in + # `destination` below): in-cluster server for unraid-lab, registered cluster + # name `oci-lab` for OCI. # # Selection (which apps run): three git generators — # apps/*/app.yaml shared (every cluster) @@ -34214,6 +34216,12 @@ cluster: elements: - clusterName: unraid-lab clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -34225,6 +34233,12 @@ cluster: elements: - clusterName: unraid-lab clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -34236,6 +34250,12 @@ cluster: elements: - clusterName: unraid-lab clusterType: homelab-kvm + destinationName: "" + destinationServer: https://kubernetes.default.svc + - clusterName: oci-lab + clusterType: cloud + destinationName: oci-lab + destinationServer: "" - git: repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps revision: HEAD @@ -34260,7 +34280,15 @@ cluster: targetRevision: HEAD ref: v destination: - server: https://kubernetes.default.svc + # oci-lab has no in-cluster Argo: target the registered external + # cluster by name. Its Secret lives in unraid-lab's argocd namespace + # (clusters/unraid-lab/apps/oci-cluster-registration). Exactly one of + # name/server is set per element — Argo resolves by name when server + # is empty, by server when name is empty. The fields stay pure YAML: + # ApplicationSet templates render AFTER YAML parsing, so conditional + # KEYS are not possible here; per-element params keep it parseable. + name: "{{ .destinationName }}" + server: "{{ .destinationServer }}" namespace: "{{.namespace}}" syncPolicy: automated: diff --git a/docs/architecture/gitops-layering.md b/docs/architecture/gitops-layering.md index 0bf5706..0d5baf8 100644 --- a/docs/architecture/gitops-layering.md +++ b/docs/architecture/gitops-layering.md @@ -1,21 +1,27 @@ # GitOps layering: base → type → cluster -How apps and config are layered across clusters. Self-managed Argo CD (each -cluster runs its own), no central hub. +How apps and config are layered across clusters. One Argo CD, hosted in +`unraid-lab`; `oci-lab` is reconciled remotely through a registered external +cluster (see Current state / TODO below). ## Bootstrap -Talos `inlineManifests` (per cluster) install Argo CD, then seed **three roots**. -The only per-cluster difference is the cluster's identity (`clusterName`, -`clusterType`), baked into the seeded `appset`. +Talos `inlineManifests` on unraid-lab install Argo CD and seed **three roots**: - **`apps`** (ApplicationSet) — syncs `apps/*`, `types//apps/*`, - `clusters//apps/*`. The **chart-apps**, values layered. + `clusters//apps/*`. The **chart-apps**, values layered. Covers BOTH + clusters; oci-lab Applications target the registered `oci-lab` cluster. - **`bootstrap`** (Application) — syncs `bootstrap/`. Shared raw manifests (tailscale operator). -- **`-raw`** (Application) — syncs - `clusters//apps/*/application.yaml`. **Custom ApplicationSets** that - aren't chart-apps (arc-runners). +- **`unraid-raw`** (Application) — syncs + `clusters/unraid-lab/apps/*/application.yaml`. **Custom ApplicationSets** + and raw apps, including the oci-* lanes below. + +On oci-lab, `inlineManifests` bootstrap **Cilium only** (plus the +`argocd-manager` service account unraid's Argo authenticates as) — no local +Argo CD. Three unraid-hosted Applications reconcile it: +`oci-cluster-registration`, `oci-raw` (`clusters/oci-lab/apps/*/application.yaml`), +`oci-bootstrap` (`bootstrap/` tailscale manifests). Chart-app lane keys on **`app.yaml`**; raw lane keys on **`application.yaml`** — so the two never double-manage an app in the same directory. @@ -70,12 +76,22 @@ Argo Application per app, with the layered `valueFiles`. ## Current state / TODO -- `appset.yaml` (repo root) is the canonical ApplicationSet. `omni/scripts/generate-manifests.sh` - already injects it into each cluster's `inlineManifests` along with the Argo CD - install manifest. +- `appset.yaml` (repo root) is the canonical ApplicationSet. It is hosted ONCE, + in unraid-lab's Argo CD (injected via unraid-lab's `inlineManifests`), and + covers BOTH clusters: static `unraid-lab`/`oci-lab` list elements; the + `destination` template targets the in-cluster server for unraid-lab and the + registered external cluster `name: oci-lab` for OCI. +- `oci-lab` runs NO local Argo CD. Its inline manifests bootstrap Cilium plus + the `argocd-manager` service account only. unraid-lab's Argo reconciles it + through the registered external cluster: + `clusters/unraid-lab/apps/oci-cluster-registration` (ExternalSecret → + argocd cluster Secret; endpoint is the private VPN-subnet API address), + `oci-raw` (raw lane for `clusters/oci-lab/apps/*/application.yaml`), + `oci-bootstrap` (tailscale-* manifests from `bootstrap/`). - `unraid-lab` is validated: all Argo CD Applications are **Synced** and **Healthy**. -- **OCI remains to be validated.** Run a no-op re-sync check on `oci-lab` before - the GitOps layering fully replaces the live setup there. +- **OCI not yet bootstrapped.** First bootstrap happens after these changes + land; validate app sync after cluster registration (see + centralize-oci-gitops-and-node-dns in syscode-ai-internal-plans). - Migrated: cert-manager, cilium (shared, `apps/`); harbor, arc-controller (unraid-only, `clusters/unraid-lab/apps/`). arc-runners stays a custom ApplicationSet on the raw lane. diff --git a/docs/deploy/runbook.md b/docs/deploy/runbook.md index c1d04ae..a9640fa 100644 --- a/docs/deploy/runbook.md +++ b/docs/deploy/runbook.md @@ -17,8 +17,9 @@ if the tailnet domain changes. ## 2. Generate inline-manifests, commit -Fills each cluster's `argocd` (install), `argocd-apps` (appset with that -cluster's identity), and — OCI only — `cilium` block: +unraid-lab (installs Argo CD + the layering ApplicationSet, which also covers +`oci-lab`); OCI gets a Cilium-only patch plus the `argocd-manager` service +account — no Argo CD on OCI: ```bash mise run oci-lab:generate-manifests @@ -32,13 +33,21 @@ Version pins live in `omni/scripts/generate-manifests.sh` (`ARGOCD_VERSION`, ## 3. Bootstrap the clusters (Omni) -Apply the Talos machine config with the generated patch through Omni. On first -control-plane boot Talos applies the inline-manifests: Argo CD installs, then the -seeded root Applications pull the rest of this repo: +Apply the Talos machine config with the generated patch through Omni. -- `argocd-apps` — the layering ApplicationSet (chart-apps, values `base → type → cluster`). +**unraid-lab**: on first control-plane boot Talos applies the +inline-manifests: Argo CD installs, then the seeded root Applications pull the +rest of this repo: + +- `argocd-apps` — the layering ApplicationSet (chart-apps; unraid-lab AND + oci-lab destinations). - `argocd-bootstrap` — syncs `bootstrap/` (Tailscale operator). -- `argocd-unraid-raw` (unraid only) — syncs `clusters/unraid-lab/apps/*/application.yaml` (arc-runners). +- `argocd-unraid-raw` — syncs `clusters/unraid-lab/apps/*/application.yaml` + (arc-runners, plus the oci-* lanes below). + +**oci-lab**: first control-plane boot applies only Cilium + the +`argocd-manager` ServiceAccount/ClusterRole/Binding. There is no Argo CD on +oci-lab; unraid-lab's Argo reconciles it once registered (step 4b). ## 4. Create in-cluster secrets @@ -51,6 +60,28 @@ Harbor being up (step 7) — create it there, not here. Generate the App private key yourself; never commit any of these. +## 4b. Register oci-lab with unraid-lab's Argo CD + +After the oci-lab cluster is up and reachable over the private path +(`unraid-lab → tailnet → wrt-london → IPSec → vpn-subnet nodeIP:6443`): + +1. Grab the kube CA + build the API URL from the oci-talos-cp-1 VPN-subnet IP + (`kubectl config view --raw` on an admin kubeconfig, or + `omnictl cluster kubeconfig`). +2. Mint a long-lived token for `argocd-manager` (kube-system): create a Secret + of type `kubernetes.io/service-account-token` annotated + `kubernetes.io/service-account.name: argocd-manager`, read `token`. +3. Store `server` (the `https://:6443` URL), `ca` (base64 CA), and + `token` in Bitwarden; put the entry's UUID into + `clusters/unraid-lab/apps/oci-cluster-registration/manifests/external-secret.yaml` + (replaces the placeholder keys) and commit. +4. ESO materializes Secret `oci-lab-cluster` in unraid's argocd ns; the + `argocd.argoproj.io/secret-type: cluster` label registers the cluster. + The `apps` ApplicationSet, `oci-raw`, and `oci-bootstrap` then sync against + it (they sit degraded until this step). + +Never commit the token or CA; they travel only through Bitwarden. + ## 5. Pre-merge gate Do not merge #17 until both pass: diff --git a/omni/cluster-templates/oci-lab.yaml b/omni/cluster-templates/oci-lab.yaml index f68ec09..50591c1 100644 --- a/omni/cluster-templates/oci-lab.yaml +++ b/omni/cluster-templates/oci-lab.yaml @@ -16,8 +16,10 @@ talos: patches: - file: patches/cni-none.yaml - file: patches/disable-kube-proxy.yaml - - file: patches/allow-scheduling.yaml - - file: patches/talos-1.14-compat.yaml + # allow-scheduling.yaml deliberately NOT applied: oci-lab's control plane + # stays dedicated (only the worker takes workloads). + # talos-1.14-compat.yaml contains SecurityProfileConfig, which Talos 1.13 + # does not register. Add it only when versions.yaml moves oci-lab to 1.14. - file: patches/oci-lab-inline-manifests.yaml --- # omnictl requires ControlPlane and Workers as SEPARATE documents. They were diff --git a/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml b/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml index a45f554..11352b5 100644 --- a/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml +++ b/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml @@ -1,26430 +1,56 @@ # Talos inline manifests applied during cluster bootstrap by the first control plane node. # These run before any workload scheduler is up, so they must be self-contained YAML. # -# REGENERATE after Cilium/Argo CD version bumps: -# mise run oci:generate-manifests +# oci-lab bootstraps Cilium ONLY. There is deliberately NO Argo CD here: +# unraid-lab's Argo reconciles all oci-lab applications through the registered +# external cluster (see clusters/unraid-lab/apps/oci-*). Regenerate Cilium: +# mise run oci-lab:generate-manifests # # Cilium is configured for: # - kubeProxyReplacement=true (Talos, no kube-proxy) # - k8sServiceHost=localhost, k8sServicePort=7445 (KubePrism — node-local API proxy) # - ipam.mode=kubernetes # -# Argo CD is the raw upstream install manifest + an inline root Application. -# The root Application syncs bootstrap/; bootstrap/argocd-app-of-apps.yaml fans -# out to infrastructure/*/application.yaml. Argo CD does not sync omni/. +# argocd-manager is the service account unraid-lab's Argo CD authenticates as. +# Its bearer token is generated POST-bootstrap and stored in Bitwarden — never +# committed here. cluster: inlineManifests: - name: cilium - contents: "---\n# Source: cilium/templates/cilium-secrets-namespace.yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n name: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\n\n---\n# Source: cilium/templates/cilium-agent/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-envoy/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-envoy\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/hubble-relay/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-relay\"\n namespace: kube-system\nautomountServiceAccountToken: false\n\n---\n# Source: cilium/templates/hubble-ui/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-ui\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-ca-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: cilium-ca\n namespace: kube-system\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMDlQQ0xDUkVkL2hzQWVPVWM5WElBUytLbUN0RWpHQUlYbEllRE9BL3B6ZDdKakwwCkp4YkcvUFhJUkdDOC9XSWpMeXdRMkxYQVBlc3JZczd2UFNPUGhpdFZXem9NQmFuMjlKK1RtRG5HN0RpWXNiMHIKQzVwNVZwc3RaMzQ4LzhnK0d1aXlJSlZMVS9kNnZsb2xPS3B0UGNWRzF1b3VMQXZqRXgzQkZSVXN3RzR1OXpLZgpPZFNwU0Fad2dNV2c4eTc0aHMyd1hkaUV4SGdaWGZ3S1JMQU5HNjhUbk5xQXhCY0xTNjQyanl4Z0UvcFp0TjMvCjdzNjdOazJKQnpqUjgwTS9iVkgyakJGU2hSby9EQWVwZFZZUE4yUkFKWmNwUzhNL1FVeGFaaWpiaUtPOWtYaWkKMkxoQXFDYnNhRmZ0ZkZmYTJiZy9ZUmg4c3VOVDZnNkFVWndLd3dJREFRQUJBb0lCQUFNZjRqWStyTFVUSHh2dQowdktvZHgzaTlmQVllbjJyL1YwMkFlRGVKTHZTWjhpNktYdVp1VTk5VDIwN2xIZXRqVFMxMHYxa0pPNStlOWltCks4VnZtWXdTWmltZkJubGZVRmZ1eTlzTDMrMzk0Ym5yQytuTXpaN0toUHc4SDF6U0hXNEJMdVVPV0U0QnF3UzcKbFhqRk5UQzB4Q1VKTmQ2TERyNkQ4U1JGSzVicmJ4RlJFOVl1blUxSmhOTlNSVjNLS0FLQzlyU2dmYjJEbE5WYgp6enNIL0hGdE0xN3FGUVVBQXgrK1dyNzQxbmg4TW9HcXdkZE1EeEx6R05FaDNoTjdiU003aFJQMkVEQ2VWUTV1CnZTY1lWeHFxZEYrKzZRUEw3dUZiMjBEVTB0Yk15MjF3RDZwc1pJM0Y4VDNjKzVaZnpUNkJmSHEvbGJqSmV4VWsKZVJiNlBwa0NnWUVBMmtDSlFxTzZwWmJrTWpsMVlNLzdZK3IxQkdGQXRvRTlyaFFWYklXUTVzcklsUEVHZWJ5bAplMjB4QmFYV3pNU2orMWVyZGl4dVFIZEpwbXFad3Q1M3pNN25mekZnM29PbHFUSTBCQmdFcjlkWG1QemVPWUF5CjR0N0xRenNwYzNReHdVbEFkWEpVaTJXVUxIbmwwUm1VOU52NnpNOWxzb2UwMnBGS1ZNN2l6Z2tDZ1lFQStIYS8KdVlXWEExSWNoUlNUUUxzRUVueEpldDJIMklsRVZsUzRkaERrcUhpTy85OUV1YWRpc3dXd0Y0anJEZHlnWXpnOQpCZGE5enlROGllcVdoNDk4QmdCTjFpb094SmhEZnFLNElwMWFVdGtBd0lkUjJuTHhaWDhsMjNzcUU1OStGSlY0ClVNSGVaNHQ2a1YvM2loeUl5dGhrZjdpd2Fnd0p4emxEd0Q3cnhXc0NnWUEva2dhbysybTFLN05DRWN4bnE0ek0KdUxZdlZXaDFBRVlIKzErV0lYMW9TKzZLdTMyb1hkTlJsU2R2UHJQSEp3dWdmUk83TXd2V0NTalJxVUVxS29SNAppbGVSaTc5c2NLb0RFMVZsVDkybG5qS3NwQkxTYXMzbm1QOVprTlR0QlE0cy8zb2YrM0kydkJxaHJjdkwwUWk3CkhZdjZ0Zm9vT3pEcGJPSmF1M3dDaVFLQmdRRGh0bjdWZXBhRlhjS3E0dFlpcDhJN1NNMDM0S2ZYL2xzbVVqQ0EKa1Rnb0U5MVVkTzlwK0xXaEREbThKNVhoTWR4Q1JvU3BHVHUxUWFYOVpDNzdWMDNENWVMUCs4VU9zNFFkTnBVdwpYT0lCQVVHOXBUQ20wbVNaWDdoMGVwN3UxS1VrN2VRdStPK2lBUU9IclRhak1PalQzV0R1NWtqZERiS1VXV0ZDCjgrWWJvUUtCZ0hpakhGMEg3dXpZaDVVaS83L2lNMHBySXVUWmhzN0xabkZQaTdsVXRXWEZPZW5mMWdrLy8wOFIKMkdLdURscHp2T0p3WTFJK2YrbndZeWNXMWF0TFNUUDFjUnBHUDByUTBnOHlMY0ZkWERNMGxFamtEVFlCdGtDcgp3bFp6djNBL3NSekFaQnhKeGUxdTdKazNPYngvaGpxNmxXMzBIZFhFWHJtL3ZxbVZBZnlzCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/hubble/tls-helm/relay-client-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-relay-client-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRTU1lN3U0N2RVK0RueUpOZXQxcWRqREFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RJek1ERXdNekk0V2hjTk1qY3dPREl6TURFdwpNekk0V2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDd3YzUEVoa2FaMThoQTQ1cE5tbVFGYUV3MkcyNDAKWVdiZlU1TzJSZDhoclBPYlFIazJGYXNRTzVub1BNYk5KdHo3OTdlYndERVh4S0ZlU1lwUERWK0c0RkJWOWhVQgpEd0FkbTBWWkQxRTBCajhGdVhQMXhhT2F6SElSM01jS1c5cG5zMjdoSFd3SkJQN2hvSitPKzd2MzkvNFd2TWJmCmxkR3VSTHd3WnYwb1EwWG5CdVl0V0NmTytPRHdwZkVYdHRZNlJZRzJ5dGVQZjFTeU52OGU5Ylo0WDIvSWR5ZVIKWXpQZmFRb245eXFFMWVaRk1zTlV5Rndra05zRUdIL3ZyVzR2a3dKbndPRWlhWWFmWWVoZlNnd0gySEtHZGJCcgo5MGE4UWhpeW85UW9kMk40U2FJb3BlMExuTU9XUkRobjhoZlJPNTA2a1BvZWhqbUl0WVBwaytnbkFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZGZGZycUtoL2llS1lrS0dxUmc0YW9zawptSkd1TUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUFjdEg4Z3hHNDdIRTVuTjNxOW16ZURKbU1MTUdkNmRUZ0ZRMUg0YVlHY294OGszZUIKY3VEdDJZMGZlVmtyUVNPZWZLaS9hU0xHb3Yvb1ljenJNK1BjL08vanBXMVlVUE96T0w3YmRzQjdvckw5WDNieQplaUg2bEJkRzNpNFhodDkrdm5uc1BGODNHYzlNZ01ybklTT1dOWnRsdW5sMGdQSU92VFlhQlpySWZVWmRHNnpyClNibUhxNDRNRXBLaHZLYjdkMlFHOVVrbWdBYmJNWS84SU14Yy9BUWQwUTR4ZG9pSkpPVHRiRXdBaktCaVMrTGoKRlVyZkhNRDBTNXAvUkNCK2pQTUgyWVd0QjA0dFF5cStuTzVZa28rZXBxbEdpbTNVYm4xUkFLQVZPMkxDVUc0agpTcHljUnVIbGtpL0huQzhlaVB2elliOUNXcU5XdHV1TkZacjUwdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc0w5enhJWkdtZGZJUU9PYVRacGtCV2hNTmh0dU5HRm0zMU9UdGtYZklhenptMEI1Ck5oV3JFRHVaNkR6R3pTYmMrL2UzbThBeEY4U2hYa21LVHcxZmh1QlFWZllWQVE4QUhadEZXUTlSTkFZL0JibHoKOWNXam1zeHlFZHpIQ2x2YVo3TnU0UjFzQ1FUKzRhQ2ZqdnU3OS9mK0ZyekczNVhScmtTOE1HYjlLRU5GNXdibQpMVmduenZqZzhLWHhGN2JXT2tXQnRzclhqMzlVc2piL0h2VzJlRjl2eUhjbmtXTXozMmtLSi9jcWhOWG1SVExEClZNaGNKSkRiQkJoLzc2MXVMNU1DWjhEaEltbUduMkhvWDBvTUI5aHlobld3YS9kR3ZFSVlzcVBVS0hkamVFbWkKS0tYdEM1ekRsa1E0Wi9JWDBUdWRPcEQ2SG9ZNWlMV0Q2WlBvSndJREFRQUJBb0lCQUJJc1ZVaHZNQUl3ZkRBagoxdUZFenlUNU1PRGRXQ3I5bXRpNm5MVUFvUzB5dmNlSVRRNUJFeG96cnFNQTRNWUdTWEdFNm5XU3dObDdSOFpNCmxIS0ZZdjJZd2RuYzJCTUlTbEJBLzFQbGJjbUdIT1BIU2tPS2cwUnU0Z214SkN3Ti9ycHI2aW91WHNYY3BDSnAKNUE0TkZ5b3JidzVDY2NaYWZybEc2dnlsRWtHWjRXZFVaekR5MzEvZjlCN2VJNlFzT0ZvYXdxZ1I3VGlYN0JtNQprcFJXVkNQY2NTQ01ic0tUeVA5S21HTE1EZms0QVVDaWJGMXlBaUpoWXdrdmpkdjl1T1hZZFBXaTNQbStGQlZkCkFxejhQVndWOGRzVWlHQXFNVjNaUWY4cDY3UWtsQTRXR0NucHBGV0E3VVdUREhYMjZCQ1VZbjFnL3F5R2dkeXIKQ0Nna1B6MENnWUVBM093TWpNazJKOXpLL0F6YUJRNFRiNlZDYlNxemlhUEQwRGRweHVubDFCblJmU3U5bVVZZQpOSVRXc2dVM3NsMVhQa1FZZUROS2RYc015QzZCcnh6Y2pvclN5RjBSaEtIVFg2RTNISmw4OEc4R2xzQ3VzbXhSCkdXQmc5ZUpNSVJKcW8rM3dIQm9WQis4UWNkSkRuUWJINDE1TTdod2c2N2R1bmlwcThRZFJvbzBDZ1lFQXpNL1QKOEpsOC9uNHpTZmlDdHJTM0o2aEFBZUdhMWdDbzdzV2VIbHVwL29OaUlEMUZZMEFQZ1BtWTFYMXZFaU9WSVByeApDU0NISVRYQjhjeDN5MjFXL0IxdkIzUWlnYnFuTjN1bGo3RExxNGY2ZENieFVNRDJRcUhReEpTOUJwRnpvMnZNCnJzMDE0UVdoUGVWL2ViTkpaT00zTktDRXJ1UzRiUFRCM3YzVElvTUNnWUJITkdHYkl1TXNsL0pvcUsvQWYxZnUKWFNKNjB3K0k1bHFmaXF5eUt3TWppS3JIb0VoODFXZTQzN1BmTHVWVHZOZjR2clB3VWYvR3U4RlQ2QUZ1Y212NApHWEIwbWVLaWtCSHp1WjlzdlYvU2tzWlo0b0tzQ1ZOZVRYMFM0enhNVUlaRWpkVWRDWjhMcnBiclNLejRPSTVHCmowZFdXNFNVMU10M2VRNTgzeklGcFFLQmdFcmxuVjJZNDRxMVg5QW5Iclh0dENTK2RGbTd4TUdKa0QxdzZ2ZXoKRWFGUExtMFh1dTRtbVFUVFFiNmdsaU9OKzVVSjcyY2xEQVZyQVRlSlRDMktHSXN0d0ZKN2Q3cjFKUDAzTEQ0MQpxdVZaWG85blJrdi9wSTZOV2lqcE00N1pWZTVuRjN5ODhuME5iLytRazJOUDJ3RVh6akppbU9MVUpWVkMxRHJWCm00WTlBb0dCQUpMUFFDU3MrdnVwWjRFdlJIVjhZNGRKYmk1UGZPREZRTmppMjZTa091K2tRT3ovQk9GQU83ZFEKTVVOcXZLemxnZ0VjRUh3U0lmWFljSGpEOVNOSnIxKzc1cEsyUmUyMmhOeVE5MCtMSnZvR2VQc21YVTB4QzVaRApnUnpob293SlQzVUJNM2hlSkVzc1Q0MDV0V0FtQUE2NHNDekZZN3gwdlk2cXM3SXMvNnFuCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/hubble/tls-helm/server-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-server-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUlpN2xLVStIRTQ2VnorQnlyLzNiR013RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTNNRGd5TXpBeApNRE15T0Zvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUs0S0RvMG8wZWJoQzRXZW81dVEKWVR5dHZkK1BZZHZBR0k3UFltQUp0R3JFdGt1TDZKZEpYUnp1QU84dW9zK00zMk43bmV3OG40dFQ5Um9BeHpkWQpwbGdabnlvcDk2VStuSUZnUjhGWkxTV3UxN2R6bjJRYVFHRW55Yy9IMnVqQ1hlSFZYQUg2ZHQvTUU0bUZuTm8yCmcrZktGWHlQcUYvSmpDd0xpR0w2QjlKa2ZEOG51QlAyZHJOa2lRZllGay9OaVlyUXQyb2YxdlhwSy9CdGpzYkIKbnhVYmxCNG9TY3RjclBqcEVMYkpCWlNrMENOZXEycnRvdExXd1o4NTNKU0Vab1R0c0tteFE1VC9mejN1OVluKwpzRWluMUdNSGFIaURYRmQ0Qit0RDUrRnNpdm45clUxK2l6TlU5Y3YzMXNxSGtKcStVREtTWUdBeWtobTNKOTU1CjQ0OENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVYxK3VvcUgrSjRwaQpRb2FwR0RocWl5U1lrYTR3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXcza3ZUZFl2Wm14ZFNGSjR3RmNyRFpIei9ORDgKSlFvNS9PTkM2S2kzSmlFazk1MGtPMlFiQ0t4US82aDRydFFQVFJSS0MzRWcxTk9RWCt6NVR1UHN2ZkFRcXpTNApLeXlQbmdEcVI5SWQrQXlsQi9PL0dIYktCdlRCbW13dXpQdzB2aU9mdHdEM1FOSjIyYUlGcVRod0UydyswdjdZCkhNc0dHTlhjTWExaXByL2RvQzg4SU1sSURHM0V1ZS9lUytvM3VUNnRQK2VseHdTWnVkZFl0TTRiM3lsQklRVVAKb3lWSFh6WEN1Vk1lYXNJNUdIY1MvTGYzTkM5eUNueXl3Tyt0SEJMd1NSTmpiSDdGdTY3T1VMd3k2ZDVmWkFWaQptVW9NL0NqNmxNbit5cUQ0QUJUNDc3amFRdndXWTFsWFZpNjI2UmNFRlBiMTQ1OUxOUVJRV3VsL0lRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBcmdvT2pTalI1dUVMaFo2am01QmhQSzI5MzQ5aDI4QVlqczlpWUFtMGFzUzJTNHZvCmwwbGRITzRBN3k2aXo0emZZM3VkN0R5ZmkxUDFHZ0RITjFpbVdCbWZLaW4zcFQ2Y2dXQkh3Vmt0SmE3WHQzT2YKWkJwQVlTZkp6OGZhNk1KZDRkVmNBZnAyMzh3VGlZV2MyamFENThvVmZJK29YOG1NTEF1SVl2b0gwbVI4UHllNApFL1oyczJTSkI5Z1dUODJKaXRDM2FoL1c5ZWtyOEcyT3hzR2ZGUnVVSGloSnkxeXMrT2tRdHNrRmxLVFFJMTZyCmF1MmkwdGJCbnpuY2xJUm1oTzJ3cWJGRGxQOS9QZTcxaWY2d1NLZlVZd2RvZUlOY1YzZ0g2MFBuNFd5SytmMnQKVFg2TE0xVDF5L2ZXeW9lUW1yNVFNcEpnWURLU0diY24zbm5qandJREFRQUJBb0lCQUFWZVFUNkR6UU9HZlQ0NQp1MkRXdmsxWFh4NHpxSWRWTzBJRTlGeEFIMUNsNWtLaVNDSTBuTE5PemkvRnJqY2hlYVkycytpMktzcHpaRitkCjQ1aENYMW5PYzdZOFM5SUFFM2UrN29SNUtiSGVaWXo2WWNDZ1N1NTRnajdNLzNXV09UT2kvZzdkMUo4K0JyLzYKeFp0ajRUY0dpdmVuOGVxSHlhQ0c5OTkwbllwN1Y0VkREb1FXZXFyNjQ4aDl5dUt1ZXVJaTFvWGYwMDJWbjFNWgpBd21UM0dNQnh5OUxRV1JJYk5BYUp4b0k5MmlvVDdlVHZUM2QxbURnNmlzQzJSWFJMSzI2L3NCN09jenUrcWlMCm9IbUVOTjg4c1d3QUl3TDBHWVZpb09LUjIyL2VoSmJmejJRcVZ5VDJOQk8rVlNTTUhFYW9vV3c3M3BzNkF5ek8KK2pEdHZRRUNnWUVBNVNmTXpSOFlPTGxCbXJBSUZlYndrbExsWC9OWVk0bDVJbFk2b2RtM0w0Sy9vdHY0SENCTgo2SlRicUVUcDMwbWZ0MzkyWHpQUGNxdDJIM01GMGcvMndMNHBjTHFEMXZuc2diOStuaExyOWUyVmFPaHdZbnAxCm1vaDlsQjA2bEpNS2V3WlZzMGlCWjFXeTNickZMSGg4U0FqY1d4SXhPSklzZDJRODI0LzVCMEVDZ1lFQXdtMWQKTEwvS0ZpVXpIS2RZa01EM25ZZUpIcjF6ZjlkeERiL1lOM3doNEpnYzg4Njh4K3lsb29DbTlxNUhkQ3BtSDRiWgpVV1g5aEgyRDREeHJjbVdydFZrd0RZTmQ1bitXVjg2R0tkMWhVRysxMnRvTWF2YmEydDA2UXc2THpGdlVYb2QwClV3SkE2OU96NVJBaUJiRytjNnBXRFNuRjQ0elYxQ1JjcDk4UmhzOENnWUFFZnlGdnJQcUdzbXZ0SXlNbGV1Q2gKbm1yTjFUS1kwV3ZGRnJnVDBQZmRRTTJOM284aHppaDVOZUtSakxpaUh3bTVTaEVDa1R1eTNsWjFDNGJEdG5oNwpFOEF3YkJpR01XVklybjlIanN0K2llanlwQTBBZ2JLcEU2Q1ROWGVlenJ2WDZpbm9XTFhoVnpjcFRxN3J6bmx4CjJHcXFodExjYjFIY0RlVjcwWGxyZ1FLQmdBTkgrVFNTSUFUenA4TXFCOUtaanhRM2YxYm5kNVdHdXoreUp5SDQKbEZISC8yVVY3aFdwcHJueFZkLy8zUERXN2xaRjNsRURXWjNzeUZiMmJoSEdLWG1zQWFXWXUvTHg0RVduRkppTQpSZUlub0hnTENmNmNIK0Zscm1BSFZOQ2tGQmRzVGNoQTEzdWpYUHZXbzl4WXZaQVNKZFdmQ05ub1BJdVIrWVpUCnUyWDlBb0dCQUlrQzJiUENUREFOMktzdGVWa24vbWFBamMxT3ZFYWlodTVkMW1xOUVEMkVXRFFuazNoSlJsNmQKNFpSQUlIZ281YSsxTmZEcEhqckhtRGtrTTVjQmMwTmhnUzlwK0w1NW16WERscnQ2RUxHdG43U2N1ZlpkaGVVbwpzcldBSy9oSkduZXM2bGtrckRtaTNsOTQ4VUJPdThkcFludldBd2pRRGp2WW5zeWtLL0k3Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/cilium-configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-config\n namespace: kube-system\ndata:\n\n # Identity allocation mode selects how identities are shared between cilium\n # nodes by setting how they are stored. The options are \"crd\", \"kvstore\" or\n # \"doublewrite-readkvstore\" / \"doublewrite-readcrd\".\n # - \"crd\" stores identities in kubernetes as CRDs (custom resource definition).\n # These can be queried with:\n # kubectl get ciliumid\n # - \"kvstore\" stores identities in an etcd kvstore, that is\n # configured below. Cilium versions before 1.6 supported only the kvstore\n # backend. Upgrades from these older cilium versions should continue using\n # the kvstore by commenting out the identity-allocation-mode below, or\n # setting it to \"kvstore\".\n # - \"doublewrite\" modes store identities in both the kvstore and CRDs. This is useful\n # for seamless migrations from the kvstore mode to the crd mode. Consult the\n # documentation for more information on how to perform the migration.\n identity-allocation-mode: crd\n\n identity-heartbeat-timeout: \"30m0s\"\n identity-gc-interval: \"15m0s\"\n cilium-endpoint-gc-interval: \"5m0s\"\n nodes-gc-interval: \"5m0s\"\n\n # If you want to run cilium in debug mode change this value to true\n debug: \"false\"\n # The agent can be put into the following three policy enforcement modes\n # default, always and never.\n # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes\n enable-policy: \"default\"\n # If you want metrics enabled in cilium-operator, set the port for\n # which the Cilium Operator will have their metrics exposed.\n # NOTE that this will open the port on the nodes where Cilium operator pod\n # is scheduled.\n operator-prometheus-serve-addr: \":9963\"\n enable-metrics: \"true\"\n enable-policy-secrets-sync: \"true\"\n policy-secrets-only-from-secrets-namespace: \"true\"\n policy-secrets-namespace: \"cilium-secrets\"\n\n # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4\n # address.\n enable-ipv4: \"true\"\n\n # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6\n # address.\n enable-ipv6: \"false\"\n # Users who wish to specify their own custom CNI configuration file must set\n # custom-cni-conf to \"true\", otherwise Cilium may overwrite the configuration.\n custom-cni-conf: \"false\"\n enable-bpf-clock-probe: \"false\"\n # If you want cilium monitor to aggregate tracing for packets, set this level\n # to \"low\", \"medium\", or \"maximum\". The higher the level, the less packets\n # that will be seen in monitor output.\n monitor-aggregation: medium\n\n # The monitor aggregation interval governs the typical time between monitor\n # notification events for each allowed connection.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-interval: \"5s\"\n\n # The monitor aggregation flags determine which TCP flags which, upon the\n # first observation, cause monitor notifications to be generated.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-flags: all\n # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic\n # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.\n bpf-map-dynamic-size-ratio: \"0.0025\"\n # bpf-policy-map-max specifies the maximum number of entries in endpoint\n # policy map (per endpoint)\n bpf-policy-map-max: \"16384\"\n # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,\n # backend and affinity maps.\n bpf-lb-map-max: \"65536\"\n bpf-lb-external-clusterip: \"false\"\n bpf-lb-source-range-all-types: \"false\"\n bpf-lb-algorithm-annotation: \"false\"\n bpf-lb-mode-annotation: \"false\"\n\n bpf-distributed-lru: \"false\"\n bpf-events-drop-enabled: \"true\"\n bpf-events-policy-verdict-enabled: \"true\"\n bpf-events-trace-enabled: \"true\"\n\n # Pre-allocation of map entries allows per-packet latency to be reduced, at\n # the expense of up-front memory allocation for the entries in the maps. The\n # default value below will minimize memory usage in the default installation;\n # users who are sensitive to latency may consider setting this to \"true\".\n #\n # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore\n # this option and behave as though it is set to \"true\".\n #\n # If this value is modified, then during the next Cilium startup the restore\n # of existing endpoints and tracking of ongoing connections may be disrupted.\n # As a result, reply packets may be dropped and the load-balancing decisions\n # for established connections may change.\n #\n # If this option is set to \"false\" during an upgrade from 1.3 or earlier to\n # 1.4 or later, then it may cause one-time disruptions during the upgrade.\n preallocate-bpf-maps: \"false\"\n\n # Name of the cluster. Only relevant when building a mesh of clusters.\n cluster-name: default\n # Unique ID of the cluster. Must be unique across all conneted clusters and\n # in the range of 1 and 255. Only relevant when building a mesh of clusters.\n cluster-id: \"0\"\n\n # Encapsulation mode for communication between nodes\n # Possible values:\n # - disabled\n # - vxlan (default)\n # - geneve\n\n routing-mode: \"tunnel\"\n tunnel-protocol: \"vxlan\"\n tunnel-source-port-range: \"0-0\"\n service-no-backend-response: \"reject\"\n\n\n # Enables L7 proxy for L7 policy enforcement and visibility\n enable-l7-proxy: \"true\"\n\n enable-ipv4-masquerade: \"true\"\n enable-ipv4-big-tcp: \"false\"\n enable-ipv6-big-tcp: \"false\"\n enable-ipv6-masquerade: \"true\"\n enable-tcx: \"true\"\n datapath-mode: \"veth\"\n enable-masquerade-to-route-source: \"false\"\n\n enable-xt-socket-fallback: \"true\"\n install-no-conntrack-iptables-rules: \"false\"\n iptables-random-fully: \"false\"\n\n auto-direct-node-routes: \"false\"\n direct-routing-skip-unreachable: \"false\"\n enable-local-redirect-policy: \"false\"\n enable-runtime-device-detection: \"true\"\n\n kube-proxy-replacement: \"true\"\n kube-proxy-replacement-healthz-bind-address: \"\"\n bpf-lb-sock: \"false\"\n enable-health-check-nodeport: \"true\"\n enable-health-check-loadbalancer-ip: \"false\"\n node-port-bind-protection: \"true\"\n enable-auto-protect-node-port-range: \"true\"\n bpf-lb-acceleration: \"disabled\"\n enable-experimental-lb: \"false\"\n enable-svc-source-range-check: \"true\"\n enable-l2-neigh-discovery: \"true\"\n arping-refresh-period: \"30s\"\n k8s-require-ipv4-pod-cidr: \"false\"\n k8s-require-ipv6-pod-cidr: \"false\"\n enable-k8s-networkpolicy: \"true\"\n enable-endpoint-lockdown-on-policy-overflow: \"false\"\n # Tell the agent to generate and write a CNI configuration file\n write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist\n cni-exclusive: \"true\"\n cni-log-file: \"/var/run/cilium/cilium-cni.log\"\n enable-endpoint-health-checking: \"true\"\n enable-health-checking: \"true\"\n health-check-icmp-failure-threshold: \"3\"\n enable-well-known-identities: \"false\"\n enable-node-selector-labels: \"false\"\n synchronize-k8s-nodes: \"true\"\n operator-api-serve-addr: \"127.0.0.1:9234\"\n\n enable-hubble: \"true\"\n # UNIX domain socket for Hubble server to listen to.\n hubble-socket-path: \"/var/run/cilium/hubble.sock\"\n hubble-export-file-max-size-mb: \"10\"\n hubble-export-file-max-backups: \"5\"\n # An additional address for Hubble server to listen to (e.g. \":4244\").\n hubble-listen-address: \":4244\"\n hubble-disable-tls: \"false\"\n hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt\n hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key\n hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt\n ipam: \"kubernetes\"\n ipam-cilium-node-update-rate: \"15s\"\n\n default-lb-service-ipam: \"lbipam\"\n egress-gateway-reconciliation-trigger-interval: \"1s\"\n enable-vtep: \"false\"\n vtep-endpoint: \"\"\n vtep-cidr: \"\"\n vtep-mask: \"\"\n vtep-mac: \"\"\n procfs: \"/host/proc\"\n bpf-root: \"/sys/fs/bpf\"\n cgroup-root: \"/run/cilium/cgroupv2\"\n enable-k8s-terminating-endpoint: \"true\"\n enable-sctp: \"false\"\n remove-cilium-node-taints: \"true\"\n set-cilium-node-taints: \"true\"\n set-cilium-is-up-condition: \"true\"\n unmanaged-pod-watcher-interval: \"15\"\n # default DNS proxy to transparent mode in non-chaining modes\n dnsproxy-enable-transparent-mode: \"true\"\n dnsproxy-socket-linger-timeout: \"10\"\n tofqdns-dns-reject-response-code: \"refused\"\n tofqdns-enable-dns-compression: \"true\"\n tofqdns-endpoint-max-ip-per-hostname: \"1000\"\n tofqdns-idle-connection-grace-period: \"0s\"\n tofqdns-max-deferred-connection-deletes: \"10000\"\n tofqdns-proxy-response-max-delay: \"100ms\"\n agent-not-ready-taint-key: \"node.cilium.io/agent-not-ready\"\n\n mesh-auth-enabled: \"true\"\n mesh-auth-queue-size: \"1024\"\n mesh-auth-rotated-identities-queue-size: \"1024\"\n mesh-auth-gc-interval: \"5m0s\"\n\n proxy-xff-num-trusted-hops-ingress: \"0\"\n proxy-xff-num-trusted-hops-egress: \"0\"\n proxy-connect-timeout: \"2\"\n proxy-initial-fetch-timeout: \"30\"\n proxy-max-requests-per-connection: \"0\"\n proxy-max-connection-duration-seconds: \"0\"\n proxy-idle-timeout-seconds: \"60\"\n proxy-max-concurrent-retries: \"128\"\n http-retry-count: \"3\"\n\n external-envoy-proxy: \"true\"\n envoy-base-id: \"0\"\n envoy-access-log-buffer-size: \"4096\"\n envoy-keep-cap-netbindservice: \"false\"\n max-connected-clusters: \"255\"\n clustermesh-enable-endpoint-sync: \"false\"\n clustermesh-enable-mcs-api: \"false\"\n\n nat-map-stats-entries: \"32\"\n nat-map-stats-interval: \"30s\"\n enable-internal-traffic-policy: \"true\"\n enable-lb-ipam: \"true\"\n enable-non-default-deny-policies: \"true\"\n enable-source-ip-verification: \"true\"\n\n# Extra config allows adding arbitrary properties to the cilium config.\n# By putting it at the end of the ConfigMap, it's also possible to override existing properties.\n---\n# Source: cilium/templates/cilium-envoy/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-envoy-config\n namespace: kube-system\ndata:\n # Keep the key name as bootstrap-config.json to avoid breaking changes\n bootstrap-config.json: |\n {\"admin\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n\n---\n# Source: cilium/templates/hubble-relay/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-relay-config\n namespace: kube-system\ndata:\n config.yaml: |\n cluster-name: default\n peer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\n listen-address: :4245\n gops: true\n gops-port: \"9893\"\n retry-timeout: \n sort-buffer-len-max: \n sort-buffer-drain-timeout: \n tls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n \n disable-server-tls: true\n\n---\n# Source: cilium/templates/hubble-ui/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-ui-nginx\n namespace: kube-system\ndata:\n nginx.conf: \"server {\\n listen 8081;\\n listen [::]:8081;\\n server_name localhost;\\n root /app;\\n index index.html;\\n client_max_body_size 1G;\\n\\n location / {\\n proxy_set_header Host $host;\\n proxy_set_header X-Real-IP $remote_addr;\\n\\n location /api {\\n proxy_http_version 1.1;\\n proxy_pass_request_headers on;\\n proxy_pass http://127.0.0.1:8090;\\n }\\n location / {\\n # double `/index.html` is required here \\n try_files $uri $uri/ /index.html /index.html;\\n }\\n\\n # Liveness probe\\n location /healthz {\\n access_log off;\\n add_header Content-Type text/plain;\\n return 200 'ok';\\n }\\n }\\n}\"\n\n---\n# Source: cilium/templates/cilium-agent/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - services\n - pods\n - endpoints\n - nodes\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - list\n - watch\n # This is used when validating policies in preflight. This will need to stay\n # until we figure out how to avoid \"get\" inside the preflight, and then\n # should be removed ideally.\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumbgppeeringpolicies\n - ciliumbgpnodeconfigs\n - ciliumbgpadvertisements\n - ciliumbgppeerconfigs\n - ciliumclusterwideenvoyconfigs\n - ciliumclusterwidenetworkpolicies\n - ciliumegressgatewaypolicies\n - ciliumendpoints\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumidentities\n - ciliumlocalredirectpolicies\n - ciliumnetworkpolicies\n - ciliumnodes\n - ciliumnodeconfigs\n - ciliumcidrgroups\n - ciliuml2announcementpolicies\n - ciliumpodippools\n verbs:\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n - ciliumendpoints\n - ciliumnodes\n verbs:\n - create\n- apiGroups:\n - cilium.io\n # To synchronize garbage collection of such resources\n resources:\n - ciliumidentities\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n verbs:\n - delete\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n - ciliumnodes/status\n verbs:\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints/status\n - ciliumendpoints\n - ciliuml2announcementpolicies/status\n - ciliumbgpnodeconfigs/status\n verbs:\n - patch\n\n---\n# Source: cilium/templates/cilium-operator/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - get\n - list\n - watch\n # to automatically delete [core|kube]dns pods so that are starting to being\n # managed by Cilium\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n resourceNames:\n - cilium-config\n verbs:\n # allow patching of the configmap to set annotations\n - patch\n- apiGroups:\n - \"\"\n resources:\n - nodes\n verbs:\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # To remove node taints\n - nodes\n # To set NetworkUnavailable false on startup\n - nodes/status\n verbs:\n - patch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform LB IP allocation for BGP\n - services/status\n verbs:\n - update\n - patch\n- apiGroups:\n - \"\"\n resources:\n # to check apiserver connectivity\n - namespaces\n - secrets\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform the translation of a CNP that contains `ToGroup` to its endpoints\n - services\n - endpoints\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies\n - ciliumclusterwidenetworkpolicies\n verbs:\n # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'\n - create\n - update\n - deletecollection\n # To update the status of the CNPs and CCNPs\n - patch\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies/status\n - ciliumclusterwidenetworkpolicies/status\n verbs:\n # Update the auto-generated CNPs and CCNPs status.\n - patch\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n - ciliumidentities\n verbs:\n # To perform garbage collection of such resources\n - delete\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n verbs:\n # To synchronize garbage collection of such resources\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n verbs:\n - create\n - update\n - get\n - list\n - watch\n # To perform CiliumNode garbage collector\n - delete\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes/status\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumbgppeerconfigs\n - ciliumbgpadvertisements\n - ciliumbgpnodeconfigs\n verbs:\n - create\n - update\n - get\n - list\n - watch\n - delete\n - patch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumbgpclusterconfigs/status\n - ciliumbgppeerconfigs/status\n verbs:\n - update\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - create\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - update\n resourceNames:\n - ciliumloadbalancerippools.cilium.io\n - ciliumbgppeeringpolicies.cilium.io\n - ciliumbgpclusterconfigs.cilium.io\n - ciliumbgppeerconfigs.cilium.io\n - ciliumbgpadvertisements.cilium.io\n - ciliumbgpnodeconfigs.cilium.io\n - ciliumbgpnodeconfigoverrides.cilium.io\n - ciliumclusterwideenvoyconfigs.cilium.io\n - ciliumclusterwidenetworkpolicies.cilium.io\n - ciliumegressgatewaypolicies.cilium.io\n - ciliumendpoints.cilium.io\n - ciliumendpointslices.cilium.io\n - ciliumenvoyconfigs.cilium.io\n - ciliumexternalworkloads.cilium.io\n - ciliumidentities.cilium.io\n - ciliumlocalredirectpolicies.cilium.io\n - ciliumnetworkpolicies.cilium.io\n - ciliumnodes.cilium.io\n - ciliumnodeconfigs.cilium.io\n - ciliumcidrgroups.cilium.io\n - ciliuml2announcementpolicies.cilium.io\n - ciliumpodippools.cilium.io\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumpodippools\n - ciliumbgppeeringpolicies\n - ciliumbgpclusterconfigs\n - ciliumbgpnodeconfigoverrides\n - ciliumbgppeerconfigs\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumpodippools\n verbs:\n - create\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools/status\n verbs:\n - patch\n# For cilium-operator running in HA mode.\n#\n# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election\n# between multiple running instances.\n# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less\n# common and fewer objects in the cluster watch \"all Leases\".\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - create\n - get\n - update\n\n---\n# Source: cilium/templates/hubble-ui/clusterrole.yaml\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - componentstatuses\n - endpoints\n - namespaces\n - nodes\n - pods\n - services\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - \"*\"\n verbs:\n - get\n - list\n - watch\n\n---\n# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium-operator\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/hubble-ui/clusterrolebinding.yaml\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: hubble-ui\nsubjects:\n- kind: ServiceAccount\n name: \"hubble-ui\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\" \n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n - watch\n\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - update\n - patch\n\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-config-agent\nsubjects:\n - kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-envoy/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n annotations:\n prometheus.io/scrape: \"true\"\n prometheus.io/port: \"9964\"\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n io.cilium/app: proxy\nspec:\n clusterIP: None\n type: ClusterIP\n selector:\n k8s-app: cilium-envoy\n ports:\n - name: envoy-metrics\n port: 9964\n protocol: TCP\n targetPort: envoy-metrics\n\n---\n# Source: cilium/templates/hubble-relay/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-relay\n namespace: kube-system\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-relay\n ports:\n - protocol: TCP\n port: 80\n targetPort: grpc\n\n---\n# Source: cilium/templates/hubble-ui/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-ui\n ports:\n - name: http\n port: 80\n targetPort: 8081\n\n---\n# Source: cilium/templates/hubble/peer-service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: hubble-peer\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: hubble-peer\n\nspec:\n selector:\n k8s-app: cilium\n ports:\n - name: peer-service\n port: 443\n protocol: TCP\n targetPort: 4244\n internalTrafficPolicy: Local\n\n---\n# Source: cilium/templates/cilium-agent/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-agent\nspec:\n selector:\n matchLabels:\n k8s-app: cilium\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium\n app.kubernetes.io/name: cilium-agent\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-agent\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-agent\n args:\n - --config-dir=/tmp/cilium/config-map\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_CLUSTERMESH_CONFIG\n value: /var/lib/cilium/clustermesh/\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n resource: limits.memory\n divisor: '1'\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n lifecycle:\n postStart:\n exec:\n command:\n - \"bash\"\n - \"-c\"\n - |\n set -o errexit\n set -o pipefail\n set -o nounset\n \n # When running in AWS ENI mode, it's likely that 'aws-node' has\n # had a chance to install SNAT iptables rules. These can result\n # in dropped traffic, so we should attempt to remove them.\n # We do it using a 'postStart' hook since this may need to run\n # for nodes which might have already been init'ed but may still\n # have dangling rules. This is safe because there are no\n # dependencies on anything that is part of the startup script\n # itself, and can be safely run multiple times per node (e.g. in\n # case of a restart).\n if [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\n then\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\n fi\n echo 'Done!'\n \n preStop:\n exec:\n command:\n - /cni-uninstall.sh\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - CHOWN\n - KILL\n - NET_ADMIN\n - NET_RAW\n - IPC_LOCK\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n - DAC_OVERRIDE\n - FOWNER\n - SETGID\n - SETUID\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n # Unprivileged containers need to mount /proc/sys/net from the host\n # to have write access\n - mountPath: /host/proc/sys/net\n name: host-proc-sys-net\n # Unprivileged containers need to mount /proc/sys/kernel from the host\n # to have write access\n - mountPath: /host/proc/sys/kernel\n name: host-proc-sys-kernel\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Unprivileged containers can't set mount propagation to bidirectional\n # in this case we will mount the bpf fs from an init container that\n # is privileged and set the mount propagation from host to container\n # in Cilium.\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium\n - name: cilium-netns\n mountPath: /var/run/cilium/netns\n mountPropagation: HostToContainer\n - name: etc-cni-netd\n mountPath: /host/etc/cni/net.d\n - name: clustermesh-secrets\n mountPath: /var/lib/cilium/clustermesh\n readOnly: true\n # Needed to be able to load kernel modules\n - name: lib-modules\n mountPath: /lib/modules\n readOnly: true\n - name: xtables-lock\n mountPath: /run/xtables.lock\n - name: hubble-tls\n mountPath: /var/lib/cilium/tls/hubble\n readOnly: true\n - name: tmp\n mountPath: /tmp\n initContainers:\n - name: config\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-dbg\n - build-config\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n volumeMounts:\n - name: tmp\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n # Required to mount cgroup2 filesystem on the underlying Kubernetes node.\n # We use nsenter command with host's cgroup and mount namespaces enabled.\n - name: mount-cgroup\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: CGROUP_ROOT\n value: /run/cilium/cgroupv2\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh and mount that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-mount /hostbin/cilium-mount;\n nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\n rm /hostbin/cilium-mount\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n - name: apply-sysctl-overwrites\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\n nsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\n rm /hostbin/cilium-sysctlfix\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n # Mount the bpf fs if it is not mounted. We will perform this task\n # from a privileged container because the mount propagation bidirectional\n # only works from privileged containers.\n - name: mount-bpf-fs\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n args:\n - 'mount | grep \"/sys/fs/bpf type bpf\" || mount -t bpf bpf /sys/fs/bpf'\n command:\n - /bin/bash\n - -c\n - --\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: Bidirectional\n - name: clean-cilium-state\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - /init-container.sh\n env:\n - name: CILIUM_ALL_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-state\n optional: true\n - name: CILIUM_BPF_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-bpf-state\n optional: true\n - name: WRITE_CNI_CONF_WHEN_READY\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: write-cni-conf-when-ready\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n drop:\n - ALL\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Required to mount cgroup filesystem from the host to cilium agent pod\n - name: cilium-cgroup\n mountPath: /run/cilium/cgroupv2\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium # wait-for-kube-proxy\n # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent\n - name: install-cni-binaries\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - \"/install-plugin.sh\"\n resources:\n requests:\n cpu: 100m\n memory: 10Mi\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: cni-path\n mountPath: /host/opt/cni/bin # .Values.cni.install\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # For sharing configuration between the \"config\" initContainer and the agent\n - name: tmp\n emptyDir: {}\n # To keep state between restarts / upgrades\n - name: cilium-run\n hostPath:\n path: /var/run/cilium\n type: DirectoryOrCreate\n # To exec into pod network namespaces\n - name: cilium-netns\n hostPath:\n path: /var/run/netns\n type: DirectoryOrCreate\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n # To mount cgroup2 filesystem on the host or apply sysctlfix\n - name: hostproc\n hostPath:\n path: /proc\n type: Directory\n # To keep state between restarts / upgrades for cgroup2 filesystem\n - name: cilium-cgroup\n hostPath:\n path: /run/cilium/cgroupv2\n type: DirectoryOrCreate\n # To install cilium cni plugin in the host\n - name: cni-path\n hostPath:\n path: /opt/cni/bin\n type: DirectoryOrCreate\n # To install cilium cni configuration in the host\n - name: etc-cni-netd\n hostPath:\n path: /etc/cni/net.d\n type: DirectoryOrCreate\n # To be able to load kernel modules\n - name: lib-modules\n hostPath:\n path: /lib/modules\n # To access iptables concurrently with other processes (e.g. kube-proxy)\n - name: xtables-lock\n hostPath:\n path: /run/xtables.lock\n type: FileOrCreate\n # Sharing socket with Cilium Envoy on the same node by using a host path\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n # To read the clustermesh configuration\n - name: clustermesh-secrets\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: cilium-clustermesh\n optional: true\n # note: items are not explicitly listed here, since the entries of this secret\n # depend on the peers configured, and that would cause a restart of all agents\n # at every addition/removal. Leaving the field empty makes each secret entry\n # to be automatically projected into the volume as a file whose name is the key.\n - secret:\n name: clustermesh-apiserver-remote-cert\n optional: true\n items:\n - key: tls.key\n path: common-etcd-client.key\n - key: tls.crt\n path: common-etcd-client.crt\n - key: ca.crt\n path: common-etcd-client-ca.crt\n # note: we configure the volume for the kvstoremesh-specific certificate\n # regardless of whether KVStoreMesh is enabled or not, so that it can be\n # automatically mounted in case KVStoreMesh gets subsequently enabled,\n # without requiring an agent restart.\n - secret:\n name: clustermesh-apiserver-local-cert\n optional: true\n items:\n - key: tls.key\n path: local-etcd-client.key\n - key: tls.crt\n path: local-etcd-client.crt\n - key: ca.crt\n path: local-etcd-client-ca.crt\n - name: host-proc-sys-net\n hostPath:\n path: /proc/sys/net\n type: Directory\n - name: host-proc-sys-kernel\n hostPath:\n path: /proc/sys/kernel\n type: Directory\n - name: hubble-tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-server-certs\n optional: true\n items:\n - key: tls.crt\n path: server.crt\n - key: tls.key\n path: server.key\n - key: ca.crt\n path: client-ca.crt\n\n---\n# Source: cilium/templates/cilium-envoy/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-envoy\n name: cilium-envoy\nspec:\n selector:\n matchLabels:\n k8s-app: cilium-envoy\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium-envoy\n name: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-envoy\n image: \"quay.io/cilium/cilium-envoy:v1.31.5-1741765102-efed3defcc70ab5b263a0fc44c93d316b846a211@sha256:377c78c13d2731f3720f931721ee309159e782d882251709cb0fac3b42c03f4b\"\n imagePullPolicy: IfNotPresent\n command:\n - /usr/bin/cilium-envoy-starter\n args:\n - '--'\n - '-c /var/run/cilium/envoy/bootstrap-config.json'\n - '--base-id 0'\n - '--log-level info'\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: envoy-metrics\n containerPort: 9964\n hostPort: 9964\n protocol: TCP\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_ADMIN\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: envoy-artifacts\n mountPath: /var/run/cilium/envoy/artifacts\n readOnly: true\n - name: envoy-config\n mountPath: /var/run/cilium/envoy/\n readOnly: true\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: HostToContainer\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium-envoy\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: cilium.io/no-schedule\n operator: NotIn\n values:\n - \"true\"\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium-envoy\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n - name: envoy-artifacts\n hostPath:\n path: \"/var/run/cilium/envoy/artifacts\"\n type: DirectoryOrCreate\n - name: envoy-config\n configMap:\n name: \"cilium-envoy-config\"\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n items:\n - key: bootstrap-config.json\n path: bootstrap-config.json\n # To keep state between restarts / upgrades\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n\n---\n# Source: cilium/templates/cilium-operator/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cilium-operator\n namespace: kube-system\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\nspec:\n # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go\n # for more details.\n replicas: 2\n selector:\n matchLabels:\n io.cilium/app: operator\n name: cilium-operator\n # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case\n # of one replica and no user configured Recreate strategy.\n # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the\n # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.\n strategy:\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 50%\n type: RollingUpdate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"9963\"\n prometheus.io/scrape: \"true\"\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\n spec:\n containers:\n - name: cilium-operator\n image: \"quay.io/cilium/operator-generic:v1.17.2@sha256:81f2d7198366e8dec2903a3a8361e4c68d47d19c68a0d42f0b7b6e3f0523f249\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-operator-generic\n args:\n - --config-dir=/tmp/cilium/config-map\n - --debug=$(CILIUM_DEBUG)\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_DEBUG\n valueFrom:\n configMapKeyRef:\n key: debug\n name: cilium-config\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: prometheus\n containerPort: 9963\n hostPort: 9963\n protocol: TCP\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 3\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 0\n periodSeconds: 5\n timeoutSeconds: 3\n failureThreshold: 5\n volumeMounts:\n - name: cilium-config-path\n mountPath: /tmp/cilium/config-map\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n hostNetwork: true\n restartPolicy: Always\n priorityClassName: system-cluster-critical\n serviceAccountName: \"cilium-operator\"\n automountServiceAccountToken: true\n # In HA mode, cilium-operator pods must not be scheduled on the same\n # node as they will clash with each other.\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n io.cilium/app: operator\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # To read the configuration from the config map\n - name: cilium-config-path\n configMap:\n name: cilium-config\n\n---\n# Source: cilium/templates/hubble-relay/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: hubble-relay\n namespace: kube-system\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-relay\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 65532\n containers:\n - name: hubble-relay\n securityContext:\n capabilities:\n drop:\n - ALL\n runAsGroup: 65532\n runAsNonRoot: true\n runAsUser: 65532\n image: \"quay.io/cilium/hubble-relay:v1.17.2@sha256:42a8db5c256c516cacb5b8937c321b2373ad7a6b0a1e5a5120d5028433d586cc\"\n imagePullPolicy: IfNotPresent\n command:\n - hubble-relay\n args:\n - serve\n ports:\n - name: grpc\n containerPort: 4245\n readinessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 3\n # livenessProbe will kill the pod, we should be very conservative\n # here on failures since killing the pod should be a last resort, and\n # we should provide enough time for relay to retry before killing it.\n livenessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 10\n # Give relay time to establish connections and make a few retries\n # before starting livenessProbes.\n initialDelaySeconds: 10\n # 10 second * 12 failures = 2 minutes of failure.\n # If relay cannot become healthy after 2 minutes, then killing it\n # might resolve whatever issue is occurring.\n #\n # 10 seconds is a reasonable retry period so we can see if it's\n # failing regularly or only sporadically.\n periodSeconds: 10\n failureThreshold: 12\n startupProbe:\n grpc:\n port: 4222\n # Give relay time to get it's certs and establish connections and\n # make a few retries before starting startupProbes.\n initialDelaySeconds: 10\n # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.\n failureThreshold: 20\n # Retry more frequently at startup so that it can be considered started more quickly.\n periodSeconds: 3\n volumeMounts:\n - name: config\n mountPath: /etc/hubble-relay\n readOnly: true\n - name: tls\n mountPath: /var/lib/hubble-relay/tls\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n \n restartPolicy: Always\n priorityClassName: \n serviceAccountName: \"hubble-relay\"\n automountServiceAccountToken: false\n terminationGracePeriodSeconds: 1\n affinity:\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - name: config\n configMap:\n name: hubble-relay-config\n items:\n - key: config.yaml\n path: config.yaml\n - name: tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-relay-client-certs\n items:\n - key: tls.crt\n path: client.crt\n - key: tls.key\n path: client.key\n - key: ca.crt\n path: hubble-server-ca.crt\n \n\n---\n# Source: cilium/templates/hubble-ui/deployment.yaml\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-ui\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 1001\n runAsGroup: 1001\n runAsUser: 1001\n priorityClassName: \n serviceAccountName: \"hubble-ui\"\n automountServiceAccountToken: true\n containers:\n - name: frontend\n image: \"quay.io/cilium/hubble-ui:v0.13.2@sha256:9e37c1296b802830834cc87342a9182ccbb71ffebb711971e849221bd9d59392\"\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8081\n livenessProbe:\n httpGet:\n path: /healthz\n port: 8081\n readinessProbe:\n httpGet:\n path: /\n port: 8081\n volumeMounts:\n - name: hubble-ui-nginx-conf\n mountPath: /etc/nginx/conf.d/default.conf\n subPath: nginx.conf\n - name: tmp-dir\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n - name: backend\n image: \"quay.io/cilium/hubble-ui-backend:v0.13.2@sha256:a034b7e98e6ea796ed26df8f4e71f83fc16465a19d166eff67a03b822c0bfa15\"\n imagePullPolicy: IfNotPresent\n env:\n - name: EVENTS_SERVER_PORT\n value: \"8090\"\n - name: FLOWS_API_ADDR\n value: \"hubble-relay:80\"\n ports:\n - name: grpc\n containerPort: 8090\n volumeMounts:\n terminationMessagePolicy: FallbackToLogsOnError\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - configMap:\n defaultMode: 420\n name: hubble-ui-nginx\n name: hubble-ui-nginx-conf\n - emptyDir: {}\n name: tmp-dir\n" - - name: argocd + contents: "---\n# Source: cilium/templates/cilium-secrets-namespace.yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n name: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\n---\n# Source: cilium/templates/cilium-agent/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-envoy\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-relay/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-relay\"\n namespace: kube-system\nautomountServiceAccountToken: false\n---\n# Source: cilium/templates/hubble-ui/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-ca-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: cilium-ca\n namespace: kube-system\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU15UDJ3ZHcwTzc4ZGlnRkhab25TRm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURnek1EQTVOVFl4TmxvWERUSTVNRGd5T1RBNQpOVFl4Tmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFuMFJYNGRSSHpob20wWVkyb2lNbSs1YzZJczlLT2N4TFFubTlYZHJ0aHdOaEttbkMKbzVERUtqMlE5ZnI1MDBRRWZoeHlLSUl3ZllGQnZOSlVITzBITDhhR0RmY0JCVUxvL2lDM0tXSnRBb3dKZHhZaQphRHJKYURrNnZHOStzM283d2Zrd1FhMTVkMy9jNnRlNzNYdnR4dlRQbVRvM2lFLzVDaUQxSmNTVUZzc2xkMGEvCjVvWkFLUkhkcFcvQS91dk1zbnNaVkpQV0YrdTAyckhHSzBGV1k2cVpucVBXOE5pdHVwRmdhSHZFMXFOdWFyTHUKbG5OaUsvQnNWR0JTcHFtb0tkMHF2ZHV0Z1QvbENHbHZGWVgxdE53SW1uNUYrSzd0SDNIbGI5OVFmSUxDRVVaaAo2eTdrTUVmSVhvQ0tZNmQyVGhOWmFlTXFYV2d4Z0ZUUXM0d000UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSGJiS1kvNlhYdWZ4ZkcwYXlZSTBTVVExL3BMTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQVZuV3lFM2dqSlZ3d25Bc3dqRFRxc0pFVXpsOFkwQTM0K2xNOUZubVhDNDZmYWFnRUZzc3NxCmxteVlsazQ2U1gvbTNCRDlWVzhGaU1xdytrUXF6aExhRUt6ZGYzWWJoWlJEd1RUUG9DWUFlUG1nZ1QrYWx6OHgKaTdGb3JoMWlnYmhwQXdRdDB4czRzQXJkNHZCZE8ybEtjSGQzUGdxUk0vQlphamNrZGI2djR1ejhwNkRyUkN3cgp0VFFWVUFFQUVOUG9VUWlROWhoK3k3UjY0d1U1RHErS1hHUVVNT1UrVnNXYWFOeEVmWmtsbEU5U2tFVHhtZE1kCjZqaUtJZjBNMkp3K2dwVEFGeElsWFpoMTJjbER0RzBVV21vSlJoNlhXRXRSTiswdUdEQ0hQV3JDU2tEMEZIMGMKeWhLWHgyMGg0MFRtM3NUVVkxTWxUOVFSR1JicmprejYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBbjBSWDRkUkh6aG9tMFlZMm9pTW0rNWM2SXM5S09jeExRbm05WGRydGh3TmhLbW5DCm81REVLajJROWZyNTAwUUVmaHh5S0lJd2ZZRkJ2TkpVSE8wSEw4YUdEZmNCQlVMby9pQzNLV0p0QW93SmR4WWkKYURySmFEazZ2RzkrczNvN3dma3dRYTE1ZDMvYzZ0ZTczWHZ0eHZUUG1UbzNpRS81Q2lEMUpjU1VGc3NsZDBhLwo1b1pBS1JIZHBXL0EvdXZNc25zWlZKUFdGK3UwMnJIR0swRldZNnFabnFQVzhOaXR1cEZnYUh2RTFxTnVhckx1CmxuTmlLL0JzVkdCU3BxbW9LZDBxdmR1dGdUL2xDR2x2RllYMXROd0ltbjVGK0s3dEgzSGxiOTlRZklMQ0VVWmgKNnk3a01FZklYb0NLWTZkMlRoTlphZU1xWFdneGdGVFFzNHdNNFFJREFRQUJBb0lCQUJKM2l6VWROeUkzdUE2TgpZR0pXYnh1M0FqK3RCMjlDTit2Q1QrbkZDOHVlNGJKWVJ3Qk9OZUNyK05YOHZ1RDNQd29jWkVROExFRXhMcDBsClNpbDhkbHZjeWdodWZvak1wRlZyRjdITnZ0UVB4cjB2TE5nbkVObHI0VnFlRnZQYWxYazlXcElTK2tXWDV0YTQKSXdsZ2FFYXNkakhQSlVkQjlwOXRDTi9UTmxTYUZLMmhxUFdBeFBiRzlDNjF6SGkxZ1lZL2NzcWVOOUhsK2VBKwpUc2VBQjAyNlNMSitEQnp3V000c2pwTnJLaW5iUWIyRnNBQTAyWml1c0NpaGRvMklPZEJJUmN4THpoZDFRRkpVCnVsRyt5TnFmeVRJSzFmcDU2UkRQMGx0MUxjUURtaHhBeHlOZ1VrTmNGdjJRc1VVVFhxU0I5bVpnNlN6ek0vL04KOVc0L21WRUNnWUVBellxRUFkYnVHZjd6c2R3YlBuZmpwYzdEZzJrZFZmVWFQNmxlbkJKWWV3NFdDMVN1ZXd6WgpmL09jWjRPdHY3NEx4RDhoU1FjdHFuUHdUbk05cW5WUVVNTzVLRXlGZWMvVVo3dVlkc2xGa2g4cW1peUxaRDRjClV4MGE2eFpJWkpFSnNGY05hOUpIYnNXUENkS21BZExhV2gxV3h4U0ZDOHV6M1hETEEyOStxTTBDZ1lFQXhsMnMKZEUrY3BjclpZVlE2b1lFQW1RanhxZHg0bTdCOFhpMEtTNDU5UzZrVEhCZUkvdkd4VEo1UTgxNmhzeUdCZWowYgpOcWtEOXN5MW1sQ0YxSWIxaytMODVQSXM2NWNxTlZKT1RhN0E3TGVwMHVVU0hFVG01L0M1Y2JNTWE0YWhZKzYvCk1vZU9UQVkzYjMyZE1TYkM4aFZ0clFsOWlFRlBmLzJNeXN5eFJHVUNnWUVBeEFncytMZ3RwTHVGWHdmbk1BQVcKTFdoekRoMHRybkt5MHk3TkhodGRLaGY0TEZ4YWdOOXpmVll4d0lSVkxUK3JaME15a3J6Mjc4L2R6R1NhMXIxRwptWkRpUWk0aFMxbE5ZcFlIeHBzVjhGUXJSSm5oWS96YzlPUVliVWgyU1B3UGVwQzhLeTZGbEg5MWVjL2ZKblFjCmJyLzJxSzdJYWNTaFNqeXVVeHQrZUswQ2dZRUFyTXJzYm1UckQ0Q2oyeVNEN2l0eFdkMXdwWVpuaVRjekh0WWQKSWJQOWNPcld1cUhGdEU3Vkl1akZtem5Ub1RhT2t1eW54L1Z5Zm9uVHA1aDgrNlNVUno1ekRQdm9KVkNJYytvKwpTMnp1b1VWYnFWbmhiTDZZWlhKTUY3N2dFc296eTlrc3M5ZGhITmhOY2RENkhOYW0ram13VUFyMFRyeVZnK2haCnZFNlNIQUVDZ1lCOW4yNkV1MkJGeWExYTVtbmxSMHI4Y3JCUXlwaFlDVi9haHZTVVRNTEN6QytUOCtxaTAvSFQKQTRXNlZCZkNoSDUyVkg1QXI3Ulg2VzBsUE1tRTU4M1hTN0c4MDNnTGhNNXZqckFYSGtwY0dDeXpHU3RsdGltZgpJRjI3NmVENVROR1ZCbDNtUHhzVHREYVRycDAyb3lpZHQ0TFd2c3Q4THN0dlpZaG04MUpxVGc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\n---\n# Source: cilium/templates/hubble/tls-helm/relay-client-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-relay-client-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU15UDJ3ZHcwTzc4ZGlnRkhab25TRm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURnek1EQTVOVFl4TmxvWERUSTVNRGd5T1RBNQpOVFl4Tmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFuMFJYNGRSSHpob20wWVkyb2lNbSs1YzZJczlLT2N4TFFubTlYZHJ0aHdOaEttbkMKbzVERUtqMlE5ZnI1MDBRRWZoeHlLSUl3ZllGQnZOSlVITzBITDhhR0RmY0JCVUxvL2lDM0tXSnRBb3dKZHhZaQphRHJKYURrNnZHOStzM283d2Zrd1FhMTVkMy9jNnRlNzNYdnR4dlRQbVRvM2lFLzVDaUQxSmNTVUZzc2xkMGEvCjVvWkFLUkhkcFcvQS91dk1zbnNaVkpQV0YrdTAyckhHSzBGV1k2cVpucVBXOE5pdHVwRmdhSHZFMXFOdWFyTHUKbG5OaUsvQnNWR0JTcHFtb0tkMHF2ZHV0Z1QvbENHbHZGWVgxdE53SW1uNUYrSzd0SDNIbGI5OVFmSUxDRVVaaAo2eTdrTUVmSVhvQ0tZNmQyVGhOWmFlTXFYV2d4Z0ZUUXM0d000UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSGJiS1kvNlhYdWZ4ZkcwYXlZSTBTVVExL3BMTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQVZuV3lFM2dqSlZ3d25Bc3dqRFRxc0pFVXpsOFkwQTM0K2xNOUZubVhDNDZmYWFnRUZzc3NxCmxteVlsazQ2U1gvbTNCRDlWVzhGaU1xdytrUXF6aExhRUt6ZGYzWWJoWlJEd1RUUG9DWUFlUG1nZ1QrYWx6OHgKaTdGb3JoMWlnYmhwQXdRdDB4czRzQXJkNHZCZE8ybEtjSGQzUGdxUk0vQlphamNrZGI2djR1ejhwNkRyUkN3cgp0VFFWVUFFQUVOUG9VUWlROWhoK3k3UjY0d1U1RHErS1hHUVVNT1UrVnNXYWFOeEVmWmtsbEU5U2tFVHhtZE1kCjZqaUtJZjBNMkp3K2dwVEFGeElsWFpoMTJjbER0RzBVV21vSlJoNlhXRXRSTiswdUdEQ0hQV3JDU2tEMEZIMGMKeWhLWHgyMGg0MFRtM3NUVVkxTWxUOVFSR1JicmprejYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTVENDQWpHZ0F3SUJBZ0lSQU5IRW5BQ0I0cW4vcjRzOFJERndKN1F3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURnek1EQTVOVFl4TmxvWERUSTNNRGd6TURBNQpOVFl4Tmxvd0l6RWhNQjhHQTFVRUF3d1lLaTVvZFdKaWJHVXRjbVZzWVhrdVkybHNhWFZ0TG1sdk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXF4ZnorRm9IbmNZQUJRQWh1VUU1YThaeS95b0cKWHRSdk5BNlN6SWkvT0EzdVhGYWdobGRCMG5EcXR1OGEyUVlqbE5PWm1FL3BTdjJ5ZG5kVEpLUHJCeURjM25oWApXL2xHdUFUSWc1b2Y0bVRpM09uamtyVjBaYUZZeCsveElMbXNTa29OaFRFSUNSMHZ1dlJvb2c5S2Q4cXhwZFNCCkxWUHVwZm5xWUNzZktNS1NWbFJ5dWFWOFBocitEaHJvRTVhbUZFcWptbTUxYXFFcE5QZS8yS3hXempQS3JiTk8KWk80VUJZVmk1U0dNZTJxYkNzWXB2TmJyYXdPWkUxT3kydlBrUTlGYWN1aHljeWhjc3ZseVBubmxNWU5lQ1FiUwpmMWkvdkIyNUVWb24xQTA1aGgyZVAvb0hOVTR3R3pwYWs3blFBa2k2VlQyM1EwZjJMazlBejNmeFp3SURBUUFCCm80R0dNSUdETUE0R0ExVWREd0VCL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUIKQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZkJnTlZIU01FR0RBV2dCUjIyeW1QK2wxN244WHh0R3NtQ05FbApFTmY2U3pBakJnTlZIUkVFSERBYWdoZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d0RRWUpLb1pJCmh2Y05BUUVMQlFBRGdnRUJBQlJ3aitqZWpjTzJlQThxdkYwbW9jL3JTcWI2THNWbWlmYjFnU29BMU1OanVtSWgKKyt4d1dzd08yeUFEZllNQjQrU0NBUWRyVnFxaGh3VWZuRGVFQTl3clJZOVQ3T21IMW00UlVXdG55eTlNRFUrZwpwZkQ5dFFLeE1qZER2bGJYWjdYMFJWbWNLc2EwSmgvekhsb3Q4cVZLMEFyYXhiNTZ2dEpBdGtBY3hjYUNmWkxlCnMvUXU1YnVwRTIrTVIzTnFqdVltWUh3VWtkVGpVOHIxMUVEeVlIK1lZYkkrM21TK1dqd0t5R3RIZTROeWYzZmEKRVdwYXVhd2FEQlQyVEVEa1BUUmJGUkVCVHhaMzNvSjN5OFY2OFVXcjFMWmRFQ1Yxc245cjI3aUthemk1enVTMgozbDFLMkd3VEVPcVpTditPejg2OU5KWTNzQS9zTWZUNmNuRG5Ydnc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBcXhmeitGb0huY1lBQlFBaHVVRTVhOFp5L3lvR1h0UnZOQTZTeklpL09BM3VYRmFnCmhsZEIwbkRxdHU4YTJRWWpsTk9abUUvcFN2MnlkbmRUSktQckJ5RGMzbmhYVy9sR3VBVElnNW9mNG1UaTNPbmoKa3JWMFphRll4Ky94SUxtc1Nrb05oVEVJQ1IwdnV2Um9vZzlLZDhxeHBkU0JMVlB1cGZucVlDc2ZLTUtTVmxSeQp1YVY4UGhyK0Rocm9FNWFtRkVxam1tNTFhcUVwTlBlLzJLeFd6alBLcmJOT1pPNFVCWVZpNVNHTWUycWJDc1lwCnZOYnJhd09aRTFPeTJ2UGtROUZhY3VoeWN5aGNzdmx5UG5ubE1ZTmVDUWJTZjFpL3ZCMjVFVm9uMUEwNWhoMmUKUC9vSE5VNHdHenBhazduUUFraTZWVDIzUTBmMkxrOUF6M2Z4WndJREFRQUJBb0lCQUF0NVNNQXY4WERRTlhJZwpaeUtRVURSOUUzc3ZLMHd5dk41bDE4eGxvMFUwRWZjWlRCeVdQM0RJWjhVcTFjY1dGVTdHdmZjcjdMNDlzemtrCm1Xdk1ubGRWQ2RyVmdTNUcwa3BHNzlkN2Y0WGtOQjZTaE5OeTNjSnZCcEFwOUNhNHJPZ3lmU09nZlNSM1U1c2IKQnVWUFZ6UWZZTGg1UHN4MlkzdTMvZExETVl5L0czdHYxajdUcUtMV2R5V0l2SkIwQkR4dkwvQWc1RStoaThVbApTUUUwRUNGVHViTDZIdHU2b0V3cEtvc2hsMzF5V2RaNjcyOTlHN2tDT2txQndlMEZ3Sk94d1lKZVVtRW9naXJZCmNSblYxdnBqLy9YRGpKMHBUK3dtbGx1S1Z5cC9nU2tvSGMyQzlpWVNBNG8vNFYrTVJuNmd0RDhNcVpxVEpubHIKKzhoWGFuRUNnWUVBNDhpZFRweGtTSWE5Z3VCSG1QdzZFRzZBZS85eXZuSG5XVXo0UFJ5MEZmV0tBcUNEbzZkYwpuVnNoK1Q3OHU5SWZURTFpRC8rVUpqN0NmLzNocmxIZVBuQ3UxeHp6SVhHSmZYWkI0VjA4cCs2SUtIc1Z6bGVlCnlkdXJxOFpUcmFwZzhLM2pydmowYktzV3dOcHRhTXZKMWQxd3JQWGZ1K2FoMU01NlB0cXN2VmtDZ1lFQXdFbWEKMmQ0ZWsyT0tWVUp6dDk1Tmt4M2ZWZFgvbDN5NVlZdFNnVjI0YzhwbW5yWjNKWmdsRC95YmhkTGUwcktmaElNMgo1NjMzMmRnV3UvWHVMV0ZSNWtkK3RUQlhBMVZ5TFVUV0YwelRwWU1kRnRBeXNxN2R1RWdZNXlJWU02SkQrM1BvCk53K0dkOUorSzV5aUdJeWFhSWVRRUtZVjVCdHM3WTc4Zk9ZYWpMOENnWUJkMXN6dmtNQkRuTGJBRHhPUDlBRWIKdWRwV3V4TVRZQ3QxLzU2WTFwVmVJb3licm5MczNjcnF6SnQvYWpLR1VmY3c0UVJRSVBOd21oUlkxRWZBSDl3VwpEeWdJV05YVTVraEZGbzNuZ1JpMitpNi90bzF5TjJpa01rcFQ5dDJNUXcreXQ0Q0FHZkhnUHMrZDNaNkxPTUZLCnlQSmRYdUd3TUVCbFFqYmNaQXdiNlFLQmdCWXk2U3VwMXdIUkJoRmR3SnBEa2RVZ0o3NXpIRFRTODF2dGg3TGoKclAzQktpTzhrUGpJSGM5QXJIdkFvblRVcGxIWURDaW5EdXdaWkZhQ3grSjVUOGswQzg3REsraDRudHZYREpoWQpDRDhkYWVoT1ZPd0lBQlRjVGZPeEhmWW9ENDBpRG5iODFkdFRjN2w1TmNWN3hmKzNWc3gxUUNXN2ZOSFlKaElOClJwZGxBb0dBWUFscFV6b1FoWkNxRFJQZWhCVVJWQk8rRjJBREdIT2FrQkFZZklmYVRqV2ZTQ0lFdE8zT1MrbVUKN1l1R2VGeEo4ODhxZGNuUUZISnphUE1oY2htcGFaRXU3Y2wrYVVueGh5VXc1NXJoLzhjd3dsdnY5RnZRd2NTeQpqaFc2NkVmTHFoTC82TjJFaCt3NzNySWxWdDAwellKOHBmSStDUk1IQ2lFM3pLMSszR2s9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n---\n# Source: cilium/templates/hubble/tls-helm/server-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-server-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU15UDJ3ZHcwTzc4ZGlnRkhab25TRm93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURnek1EQTVOVFl4TmxvWERUSTVNRGd5T1RBNQpOVFl4Tmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFuMFJYNGRSSHpob20wWVkyb2lNbSs1YzZJczlLT2N4TFFubTlYZHJ0aHdOaEttbkMKbzVERUtqMlE5ZnI1MDBRRWZoeHlLSUl3ZllGQnZOSlVITzBITDhhR0RmY0JCVUxvL2lDM0tXSnRBb3dKZHhZaQphRHJKYURrNnZHOStzM283d2Zrd1FhMTVkMy9jNnRlNzNYdnR4dlRQbVRvM2lFLzVDaUQxSmNTVUZzc2xkMGEvCjVvWkFLUkhkcFcvQS91dk1zbnNaVkpQV0YrdTAyckhHSzBGV1k2cVpucVBXOE5pdHVwRmdhSHZFMXFOdWFyTHUKbG5OaUsvQnNWR0JTcHFtb0tkMHF2ZHV0Z1QvbENHbHZGWVgxdE53SW1uNUYrSzd0SDNIbGI5OVFmSUxDRVVaaAo2eTdrTUVmSVhvQ0tZNmQyVGhOWmFlTXFYV2d4Z0ZUUXM0d000UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSGJiS1kvNlhYdWZ4ZkcwYXlZSTBTVVExL3BMTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQVZuV3lFM2dqSlZ3d25Bc3dqRFRxc0pFVXpsOFkwQTM0K2xNOUZubVhDNDZmYWFnRUZzc3NxCmxteVlsazQ2U1gvbTNCRDlWVzhGaU1xdytrUXF6aExhRUt6ZGYzWWJoWlJEd1RUUG9DWUFlUG1nZ1QrYWx6OHgKaTdGb3JoMWlnYmhwQXdRdDB4czRzQXJkNHZCZE8ybEtjSGQzUGdxUk0vQlphamNrZGI2djR1ejhwNkRyUkN3cgp0VFFWVUFFQUVOUG9VUWlROWhoK3k3UjY0d1U1RHErS1hHUVVNT1UrVnNXYWFOeEVmWmtsbEU5U2tFVHhtZE1kCjZqaUtJZjBNMkp3K2dwVEFGeElsWFpoMTJjbER0RzBVV21vSlJoNlhXRXRSTiswdUdEQ0hQV3JDU2tEMEZIMGMKeWhLWHgyMGg0MFRtM3NUVVkxTWxUOVFSR1JicmprejYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUwrOUNJVlhPaVZlaDZqcTM3cHRvbll3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURnek1EQTVOVFl4TmxvWERUSTNNRGd6TURBNQpOVFl4Tmxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUs5SUZWdDB0emhjbEFqUlBoZjEKaEF2OHJ2R3RXZ2Uyc1o2VHQzS0VZd3Jydyt3azZRUWhwdSsxVXdRVndudVFFaGJGYlFRbTJYY0hIOVBUZG5NNgpCaGpIUjBIT2hxWDZvOWduTWdMNDdtRUcwSDB5UXN2M3BTMWpjVFFvTDZrNjFSLy9DNzdPVnhBaVZ6V1dBQzVDCnhsZlpDVnZYS0JBS2FFYVQvTUF0ZGpDaHArcVRPZTB5R1RCNXEwTmkzcDlrSER5cW9NOExwTDM2K3k4MzlGZUoKbFoyZWFQbnl3cEFMSlY2NFVsQ2U0WVdiSWF0WFBMODBmQ1dRckVQVDRnUndUN0NCREZJOFowN2RTZ0U3Z0RwNwpHQ0FOcklnQkxSUUVqL2JyUjE4ayswNWFzaW41Z01yWlM0YmIyNllVdXdkTjYreTdaU3IyY3cvcmxwcnJ1NVYyCjhqTUNBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVWR0c3BqL3BkZTUvRgo4YlJySmdqUkpSRFgra3N3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUpTa2ZvcTBIZ0RJWmVOWUx1dERoZUo2Rm04THMKUXFCaHR2RXVpT0NFVk5SZmFTcC9qS204STF2eWVmUDdOVkpwWGMyZWd1RTNLdG9CeXpXd1RYTEprRytLdjZFRgpPK0pBVlhLYnFSTlptVG9DYU8vMXZkcldCa2w0UHF0dmtXTG5yamhhQldySTVIazhDY2V5MGtCeUF4MndtK1JSCk9XUjloN0o5cWdpQzJ0NW11OHBHbWZrOFJKeEVMbmZJV0FBV3VYL01lWnc2YXlIenFrSU81bVRHREN1WHNDNXIKcWdUbU5MbXhhNTFKWmJMemd5VXVpNzFQcTVDa0pnZ21kTXRlamZ1bmd3TW5Rb0NtOGR3QXFiUUtIS3ZlSjhZVwpXMCs5MDZXMlYxOTJqd1YrOXhpZGpGTkpLLzAvK2JLbGZXWDc0UzNzMU5TYzBIdjFiSUd2WDdKYm1RPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBcjBnVlczUzNPRnlVQ05FK0YvV0VDL3l1OGExYUI3YXhucE8zY29SakN1dkQ3Q1RwCkJDR203N1ZUQkJYQ2U1QVNGc1Z0QkNiWmR3Y2YwOU4yY3pvR0dNZEhRYzZHcGZxajJDY3lBdmp1WVFiUWZUSkMKeS9lbExXTnhOQ2d2cVRyVkgvOEx2czVYRUNKWE5aWUFMa0xHVjlrSlc5Y29FQXBvUnBQOHdDMTJNS0duNnBNNQo3VElaTUhtclEyTGVuMlFjUEtxZ3p3dWt2ZnI3THpmMFY0bVZuWjVvK2ZMQ2tBc2xYcmhTVUo3aGhac2hxMWM4CnZ6UjhKWkNzUTlQaUJIQlBzSUVNVWp4blR0MUtBVHVBT25zWUlBMnNpQUV0RkFTUDl1dEhYeVQ3VGxxeUtmbUEKeXRsTGh0dmJwaFM3QjAzcjdMdGxLdlp6RCt1V211dTdsWGJ5TXdJREFRQUJBb0lCQUN1dy9DSGY1Z3ZXaDgvcQoyRitBZzNtNWNxSXJZOVdvWkgzeXREZUhhR2pBZkFYUTdZUnFId0tCWUVBVWJIWUFZNEhwbEZNRW5CQmZaaitXCjVsK3lodktHT2V6ZFhoTGhkeFhhTDAwdVg3MHZ4YWh2YnRjSTA5T01oaHRLS1JjMTR3b211UGJHMkV6ZFFuL0kKOUNLVDRuempUTUhuejhTdjAyNUVWU3hTS0xQV0xoanZlZDUzbSt5M2JURU5MTkhQY1dRNDNKOURKYitWQkgwdwpTa2tXRlJETC9SYWtGZFJBa3pWemo1UHlGZlFtbUhMZjBDcUVJYWp1VTVndm01US9maDRPZ1FhUHV6bWwrMk1wCm9rMUJhNmUxS2lCdzE3K1FsV2xFaElPZGhmS0ZvT2U0QmwxWnVNUHA5L3ZvN3hyRXJveXY5ZFVKUExGYkdJWXYKdFFJaUpnRUNnWUVBM3BkNlhMVGdwbURTVTNVWms0SFhLaFBHZ1FKbFdFbzJjbUNVQU5TTGNSY2lwSU9UQXlZdQpiRXR0N3Z0MVBBWkV4WVFCU0dnaXk2NlQ1MmFKYXZCNnduMVpxa1g1aVpiNTBsUndFQUF2bXF4WWhlM3kxZ1BiCi96bWw0TFFBeThadFhhaHBXU3VSS1FlWDE0YlBrSC94OHk5NkZCS1grcUFFT05PckM2dVRDR01DZ1lFQXlaYlYKWDJJcTdGbUJVNmxFRDdVTmhjanpKN0lUU2ljZi9SMExvMkZqZCttQjBYV2FlWlFpejh3NkF1N1dQMW5IL3Z1VQpGc2VVNGlnQmxtQmYrQ1ZXVEV4SHZmejBXN0RaVy9Oc1V3alhndE01Z29pVlc1SG9qTkx0N2ZBUHVlK012bHVQCjd4OW40ZGc3emw5eG45Q0RzVUlxOWtCQUdyOUR1NGh3cHh2c3ovRUNnWUJDbGtQbmVjQitaUlptR3ZDa3ZNRzEKOTZaNUwxTkwzeDk4aGNHZ29mUjR4emY0eU5kd3FMcFljUlFZMnFaT1ozMnBMSDBKd1FVdnN6RFJsMDNpYkwvOApjRzBqVDcxL1dHZXhjTXI1TG1VUE95RmNKenR1cEVicWliOUNnZlorL3dQMmNZdmFQZnMxcit6UGI2ZW1EWEErCmxHUkxudWhSOUE1dlJYcTBpZ1g1Q3dLQmdEL0hzQ1NvaTRvUjI0QWJ1c1A1ZFpqUmRsVWwyMEtIMUhBaHcyL2kKdlRUUU5WbVBDdHZTaVowVE1YdUNFMWtoejh3VnpzblNSWUcwUktST1E2N2dLVWlramNKSGlReUZqSSt5R2FDLwoyR2UwNnFvcENwQlpQcWxuaHczVCtUWEwyOHpTYlZ5cnBCTnBkYXFhdWZsbFlIVXh5U1AyT2hIOFY3SzZ2V0d4CnpTQVJBb0dBVjRXbi9JNjlJVFgwN1V2QTFvTUdDVlJuQnQzTmRYWmJzN3JRT3poTVlhemR1SVFsck9DcFUweHkKL3k0YWozcFh4anBQTzU1NjRxZXZ6TGpjc3ZETWcwS3VqL2Fhd0NsWXdUZXBJRS9KNG5HWk1qVm5LcWRQaEJMRQpvZ1VFblpkT1o0UlpIQXlJRXZmZU1IY3ZOUHRnNDNiaGI3TDlodkx0VUZzVlI0UFpBRVk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n---\n# Source: cilium/templates/cilium-configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-config\n namespace: kube-system\ndata:\n\n # Identity allocation mode selects how identities are shared between cilium\n # nodes by setting how they are stored. The options are \"crd\", \"kvstore\" or\n # \"doublewrite-readkvstore\" / \"doublewrite-readcrd\".\n # - \"crd\" stores identities in kubernetes as CRDs (custom resource definition).\n # These can be queried with:\n # kubectl get ciliumid\n # - \"kvstore\" stores identities in an etcd kvstore, that is\n # configured below. Cilium versions before 1.6 supported only the kvstore\n # backend. Upgrades from these older cilium versions should continue using\n # the kvstore by commenting out the identity-allocation-mode below, or\n # setting it to \"kvstore\".\n # - \"doublewrite\" modes store identities in both the kvstore and CRDs. This is useful\n # for seamless migrations from the kvstore mode to the crd mode. Consult the\n # documentation for more information on how to perform the migration.\n identity-allocation-mode: crd\n\n identity-heartbeat-timeout: \"30m0s\"\n identity-gc-interval: \"15m0s\"\n cilium-endpoint-gc-interval: \"5m0s\"\n nodes-gc-interval: \"5m0s\"\n\n # If you want to run cilium in debug mode change this value to true\n debug: \"false\"\n debug-verbose: \"\"\n # The agent can be put into the following three policy enforcement modes\n # default, always and never.\n # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes\n enable-policy: \"default\"\n policy-cidr-match-mode: \"\"\n # If you want metrics enabled in cilium-operator, set the port for\n # which the Cilium Operator will have their metrics exposed.\n # NOTE that this will open the port on the nodes where Cilium operator pod\n # is scheduled.\n operator-prometheus-serve-addr: \":9963\"\n enable-metrics: \"true\"\n enable-policy-secrets-sync: \"true\"\n policy-secrets-only-from-secrets-namespace: \"true\"\n policy-secrets-namespace: \"cilium-secrets\"\n\n # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4\n # address.\n enable-ipv4: \"true\"\n\n # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6\n # address.\n enable-ipv6: \"false\"\n # Users who wish to specify their own custom CNI configuration file must set\n # custom-cni-conf to \"true\", otherwise Cilium may overwrite the configuration.\n custom-cni-conf: \"false\"\n enable-bpf-clock-probe: \"false\"\n # If you want cilium monitor to aggregate tracing for packets, set this level\n # to \"low\", \"medium\", or \"maximum\". The higher the level, the less packets\n # that will be seen in monitor output.\n monitor-aggregation: medium\n\n # The monitor aggregation interval governs the typical time between monitor\n # notification events for each allowed connection.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-interval: \"5s\"\n\n # The monitor aggregation flags determine which TCP flags which, upon the\n # first observation, cause monitor notifications to be generated.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-flags: all\n # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic\n # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.\n bpf-map-dynamic-size-ratio: \"0.0025\"\n # bpf-policy-map-max specifies the maximum number of entries in endpoint\n # policy map (per endpoint)\n bpf-policy-map-max: \"16384\"\n # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,\n # backend and affinity maps.\n bpf-lb-map-max: \"65536\"\n bpf-lb-external-clusterip: \"false\"\n bpf-lb-source-range-all-types: \"false\"\n bpf-lb-algorithm-annotation: \"false\"\n bpf-lb-mode-annotation: \"false\"\n\n bpf-distributed-lru: \"false\"\n bpf-events-drop-enabled: \"true\"\n bpf-events-policy-verdict-enabled: \"true\"\n bpf-events-trace-enabled: \"true\"\n\n # Pre-allocation of map entries allows per-packet latency to be reduced, at\n # the expense of up-front memory allocation for the entries in the maps. The\n # default value below will minimize memory usage in the default installation;\n # users who are sensitive to latency may consider setting this to \"true\".\n #\n # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore\n # this option and behave as though it is set to \"true\".\n #\n # If this value is modified, then during the next Cilium startup the restore\n # of existing endpoints and tracking of ongoing connections may be disrupted.\n # As a result, reply packets may be dropped and the load-balancing decisions\n # for established connections may change.\n #\n # If this option is set to \"false\" during an upgrade from 1.3 or earlier to\n # 1.4 or later, then it may cause one-time disruptions during the upgrade.\n preallocate-bpf-maps: \"false\"\n\n # Name of the cluster. Only relevant when building a mesh of clusters.\n cluster-name: default\n # Unique ID of the cluster. Must be unique across all conneted clusters and\n # in the range of 1 and 255. Only relevant when building a mesh of clusters.\n cluster-id: \"0\"\n\n # Encapsulation mode for communication between nodes\n # Possible values:\n # - disabled\n # - vxlan (default)\n # - geneve\n\n routing-mode: \"tunnel\"\n tunnel-protocol: \"vxlan\"\n tunnel-source-port-range: \"0-0\"\n service-no-backend-response: \"reject\"\n\n\n # Enables L7 proxy for L7 policy enforcement and visibility\n enable-l7-proxy: \"true\"\n\n enable-ipv4-masquerade: \"true\"\n enable-ipv4-big-tcp: \"false\"\n enable-ipv6-big-tcp: \"false\"\n enable-ipv6-masquerade: \"true\"\n enable-tcx: \"true\"\n datapath-mode: \"veth\"\n enable-masquerade-to-route-source: \"false\"\n\n enable-xt-socket-fallback: \"true\"\n install-no-conntrack-iptables-rules: \"false\"\n iptables-random-fully: \"false\"\n\n auto-direct-node-routes: \"false\"\n direct-routing-skip-unreachable: \"false\"\n enable-local-redirect-policy: \"false\"\n enable-runtime-device-detection: \"true\"\n\n kube-proxy-replacement: \"true\"\n kube-proxy-replacement-healthz-bind-address: \"\"\n bpf-lb-sock: \"false\"\n nodeport-addresses: \"\"\n enable-health-check-nodeport: \"true\"\n enable-health-check-loadbalancer-ip: \"false\"\n node-port-bind-protection: \"true\"\n enable-auto-protect-node-port-range: \"true\"\n bpf-lb-acceleration: \"disabled\"\n enable-experimental-lb: \"false\"\n enable-svc-source-range-check: \"true\"\n enable-l2-neigh-discovery: \"true\"\n arping-refresh-period: \"30s\"\n k8s-require-ipv4-pod-cidr: \"false\"\n k8s-require-ipv6-pod-cidr: \"false\"\n enable-k8s-networkpolicy: \"true\"\n enable-endpoint-lockdown-on-policy-overflow: \"false\"\n # Tell the agent to generate and write a CNI configuration file\n write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist\n cni-exclusive: \"true\"\n cni-log-file: \"/var/run/cilium/cilium-cni.log\"\n enable-endpoint-health-checking: \"true\"\n enable-health-checking: \"true\"\n health-check-icmp-failure-threshold: \"3\"\n enable-well-known-identities: \"false\"\n enable-node-selector-labels: \"false\"\n synchronize-k8s-nodes: \"true\"\n operator-api-serve-addr: \"127.0.0.1:9234\"\n\n enable-hubble: \"true\"\n # UNIX domain socket for Hubble server to listen to.\n hubble-socket-path: \"/var/run/cilium/hubble.sock\"\n hubble-export-file-max-size-mb: \"10\"\n hubble-export-file-max-backups: \"5\"\n # An additional address for Hubble server to listen to (e.g. \":4244\").\n hubble-listen-address: \":4244\"\n hubble-disable-tls: \"false\"\n hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt\n hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key\n hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt\n ipam: \"kubernetes\"\n ipam-cilium-node-update-rate: \"15s\"\n\n default-lb-service-ipam: \"lbipam\"\n egress-gateway-reconciliation-trigger-interval: \"1s\"\n enable-vtep: \"false\"\n vtep-endpoint: \"\"\n vtep-cidr: \"\"\n vtep-mask: \"\"\n vtep-mac: \"\"\n bpf-root: \"/sys/fs/bpf\"\n cgroup-root: \"/run/cilium/cgroupv2\"\n enable-k8s-terminating-endpoint: \"true\"\n enable-sctp: \"false\"\n remove-cilium-node-taints: \"true\"\n set-cilium-node-taints: \"true\"\n set-cilium-is-up-condition: \"true\"\n unmanaged-pod-watcher-interval: \"15\"\n # default DNS proxy to transparent mode in non-chaining modes\n dnsproxy-enable-transparent-mode: \"true\"\n dnsproxy-socket-linger-timeout: \"10\"\n tofqdns-dns-reject-response-code: \"refused\"\n tofqdns-enable-dns-compression: \"true\"\n tofqdns-endpoint-max-ip-per-hostname: \"1000\"\n tofqdns-idle-connection-grace-period: \"0s\"\n tofqdns-max-deferred-connection-deletes: \"10000\"\n tofqdns-proxy-response-max-delay: \"100ms\"\n agent-not-ready-taint-key: \"node.cilium.io/agent-not-ready\"\n\n mesh-auth-enabled: \"true\"\n mesh-auth-queue-size: \"1024\"\n mesh-auth-rotated-identities-queue-size: \"1024\"\n mesh-auth-gc-interval: \"5m0s\"\n\n proxy-xff-num-trusted-hops-ingress: \"0\"\n proxy-xff-num-trusted-hops-egress: \"0\"\n proxy-connect-timeout: \"2\"\n proxy-initial-fetch-timeout: \"30\"\n proxy-max-requests-per-connection: \"0\"\n proxy-max-connection-duration-seconds: \"0\"\n proxy-idle-timeout-seconds: \"60\"\n proxy-max-concurrent-retries: \"128\"\n http-retry-count: \"3\"\n\n external-envoy-proxy: \"true\"\n envoy-base-id: \"0\"\n envoy-access-log-buffer-size: \"4096\"\n envoy-keep-cap-netbindservice: \"false\"\n max-connected-clusters: \"255\"\n clustermesh-enable-endpoint-sync: \"false\"\n clustermesh-enable-mcs-api: \"false\"\n\n nat-map-stats-entries: \"32\"\n nat-map-stats-interval: \"30s\"\n enable-internal-traffic-policy: \"true\"\n enable-lb-ipam: \"true\"\n enable-non-default-deny-policies: \"true\"\n enable-source-ip-verification: \"true\"\n\n# Extra config allows adding arbitrary properties to the cilium config.\n# By putting it at the end of the ConfigMap, it's also possible to override existing properties.\n---\n# Source: cilium/templates/cilium-envoy/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-envoy-config\n namespace: kube-system\ndata:\n # Keep the key name as bootstrap-config.json to avoid breaking changes\n bootstrap-config.json: |\n {\"admin\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n---\n# Source: cilium/templates/hubble-relay/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-relay-config\n namespace: kube-system\ndata:\n config.yaml: |\n cluster-name: default\n peer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\n listen-address: :4245\n gops: true\n gops-port: \"9893\"\n retry-timeout: \n sort-buffer-len-max: \n sort-buffer-drain-timeout: \n tls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n \n disable-server-tls: true\n---\n# Source: cilium/templates/hubble-ui/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-ui-nginx\n namespace: kube-system\ndata:\n nginx.conf: \"server {\\n listen 8081;\\n listen [::]:8081;\\n server_name localhost;\\n root /app;\\n index index.html;\\n client_max_body_size 1G;\\n\\n location / {\\n proxy_set_header Host $host;\\n proxy_set_header X-Real-IP $remote_addr;\\n\\n location /api {\\n proxy_http_version 1.1;\\n proxy_pass_request_headers on;\\n proxy_pass http://127.0.0.1:8090;\\n }\\n location / {\\n # double `/index.html` is required here \\n try_files $uri $uri/ /index.html /index.html;\\n }\\n\\n # Liveness probe\\n location /healthz {\\n access_log off;\\n add_header Content-Type text/plain;\\n return 200 'ok';\\n }\\n }\\n}\"\n---\n# Source: cilium/templates/cilium-agent/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - services\n - pods\n - endpoints\n - nodes\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - list\n - watch\n # This is used when validating policies in preflight. This will need to stay\n # until we figure out how to avoid \"get\" inside the preflight, and then\n # should be removed ideally.\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumbgppeeringpolicies\n - ciliumbgpnodeconfigs\n - ciliumbgpadvertisements\n - ciliumbgppeerconfigs\n - ciliumclusterwideenvoyconfigs\n - ciliumclusterwidenetworkpolicies\n - ciliumegressgatewaypolicies\n - ciliumendpoints\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumidentities\n - ciliumlocalredirectpolicies\n - ciliumnetworkpolicies\n - ciliumnodes\n - ciliumnodeconfigs\n - ciliumcidrgroups\n - ciliuml2announcementpolicies\n - ciliumpodippools\n verbs:\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n - ciliumendpoints\n - ciliumnodes\n verbs:\n - create\n- apiGroups:\n - cilium.io\n # To synchronize garbage collection of such resources\n resources:\n - ciliumidentities\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n verbs:\n - delete\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n - ciliumnodes/status\n verbs:\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints/status\n - ciliumendpoints\n - ciliuml2announcementpolicies/status\n - ciliumbgpnodeconfigs/status\n verbs:\n - patch\n---\n# Source: cilium/templates/cilium-operator/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - get\n - list\n - watch\n # to automatically delete [core|kube]dns pods so that are starting to being\n # managed by Cilium\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n resourceNames:\n - cilium-config\n verbs:\n # allow patching of the configmap to set annotations\n - patch\n- apiGroups:\n - \"\"\n resources:\n - nodes\n verbs:\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # To remove node taints\n - nodes\n # To set NetworkUnavailable false on startup\n - nodes/status\n verbs:\n - patch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform LB IP allocation for BGP\n - services/status\n verbs:\n - update\n - patch\n- apiGroups:\n - \"\"\n resources:\n # to check apiserver connectivity\n - namespaces\n - secrets\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform the translation of a CNP that contains `ToGroup` to its endpoints\n - services\n - endpoints\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies\n - ciliumclusterwidenetworkpolicies\n verbs:\n # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'\n - create\n - update\n - deletecollection\n # To update the status of the CNPs and CCNPs\n - patch\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies/status\n - ciliumclusterwidenetworkpolicies/status\n verbs:\n # Update the auto-generated CNPs and CCNPs status.\n - patch\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n - ciliumidentities\n verbs:\n # To perform garbage collection of such resources\n - delete\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n verbs:\n # To synchronize garbage collection of such resources\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n verbs:\n - create\n - update\n - get\n - list\n - watch\n # To perform CiliumNode garbage collector\n - delete\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes/status\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumbgppeerconfigs\n - ciliumbgpadvertisements\n - ciliumbgpnodeconfigs\n verbs:\n - create\n - update\n - get\n - list\n - watch\n - delete\n - patch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumbgpclusterconfigs/status\n - ciliumbgppeerconfigs/status\n verbs:\n - update\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - create\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - update\n resourceNames:\n - ciliumloadbalancerippools.cilium.io\n - ciliumbgppeeringpolicies.cilium.io\n - ciliumbgpclusterconfigs.cilium.io\n - ciliumbgppeerconfigs.cilium.io\n - ciliumbgpadvertisements.cilium.io\n - ciliumbgpnodeconfigs.cilium.io\n - ciliumbgpnodeconfigoverrides.cilium.io\n - ciliumclusterwideenvoyconfigs.cilium.io\n - ciliumclusterwidenetworkpolicies.cilium.io\n - ciliumegressgatewaypolicies.cilium.io\n - ciliumendpoints.cilium.io\n - ciliumendpointslices.cilium.io\n - ciliumenvoyconfigs.cilium.io\n - ciliumexternalworkloads.cilium.io\n - ciliumidentities.cilium.io\n - ciliumlocalredirectpolicies.cilium.io\n - ciliumnetworkpolicies.cilium.io\n - ciliumnodes.cilium.io\n - ciliumnodeconfigs.cilium.io\n - ciliumcidrgroups.cilium.io\n - ciliuml2announcementpolicies.cilium.io\n - ciliumpodippools.cilium.io\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumpodippools\n - ciliumbgppeeringpolicies\n - ciliumbgpclusterconfigs\n - ciliumbgpnodeconfigoverrides\n - ciliumbgppeerconfigs\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumpodippools\n verbs:\n - create\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools/status\n verbs:\n - patch\n# For cilium-operator running in HA mode.\n#\n# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election\n# between multiple running instances.\n# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less\n# common and fewer objects in the cluster watch \"all Leases\".\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - create\n - get\n - update\n---\n# Source: cilium/templates/hubble-ui/clusterrole.yaml\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - componentstatuses\n - endpoints\n - namespaces\n - nodes\n - pods\n - services\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - \"*\"\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium-operator\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-ui/clusterrolebinding.yaml\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: hubble-ui\nsubjects:\n- kind: ServiceAccount\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\" \n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - update\n - patch\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-config-agent\nsubjects:\n - kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n annotations:\n prometheus.io/scrape: \"true\"\n prometheus.io/port: \"9964\"\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n io.cilium/app: proxy\nspec:\n clusterIP: None\n type: ClusterIP\n selector:\n k8s-app: cilium-envoy\n ports:\n - name: envoy-metrics\n port: 9964\n protocol: TCP\n targetPort: envoy-metrics\n---\n# Source: cilium/templates/hubble-relay/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-relay\n namespace: kube-system\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-relay\n ports:\n - protocol: TCP\n port: 80\n targetPort: grpc\n---\n# Source: cilium/templates/hubble-ui/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-ui\n ports:\n - name: http\n port: 80\n targetPort: 8081\n---\n# Source: cilium/templates/hubble/peer-service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: hubble-peer\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: hubble-peer\n\nspec:\n selector:\n k8s-app: cilium\n ports:\n - name: peer-service\n port: 443\n protocol: TCP\n targetPort: 4244\n internalTrafficPolicy: Local\n---\n# Source: cilium/templates/cilium-agent/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-agent\nspec:\n selector:\n matchLabels:\n k8s-app: cilium\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium\n app.kubernetes.io/name: cilium-agent\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-agent\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-agent\n args:\n - --config-dir=/tmp/cilium/config-map\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_CLUSTERMESH_CONFIG\n value: /var/lib/cilium/clustermesh/\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n resource: limits.memory\n divisor: '1'\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n lifecycle:\n postStart:\n exec:\n command:\n - \"bash\"\n - \"-c\"\n - |\n set -o errexit\n set -o pipefail\n set -o nounset\n \n # When running in AWS ENI mode, it's likely that 'aws-node' has\n # had a chance to install SNAT iptables rules. These can result\n # in dropped traffic, so we should attempt to remove them.\n # We do it using a 'postStart' hook since this may need to run\n # for nodes which might have already been init'ed but may still\n # have dangling rules. This is safe because there are no\n # dependencies on anything that is part of the startup script\n # itself, and can be safely run multiple times per node (e.g. in\n # case of a restart).\n if [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\n then\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\n fi\n echo 'Done!'\n \n preStop:\n exec:\n command:\n - /cni-uninstall.sh\n securityContext:\n privileged: true\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: Bidirectional\n - name: cilium-run\n mountPath: /var/run/cilium\n - name: cilium-netns\n mountPath: /var/run/cilium/netns\n mountPropagation: HostToContainer\n - name: etc-cni-netd\n mountPath: /host/etc/cni/net.d\n - name: clustermesh-secrets\n mountPath: /var/lib/cilium/clustermesh\n readOnly: true\n # Needed to be able to load kernel modules\n - name: lib-modules\n mountPath: /lib/modules\n readOnly: true\n - name: xtables-lock\n mountPath: /run/xtables.lock\n - name: hubble-tls\n mountPath: /var/lib/cilium/tls/hubble\n readOnly: true\n - name: tmp\n mountPath: /tmp\n initContainers:\n - name: config\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-dbg\n - build-config\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n volumeMounts:\n - name: tmp\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n # Required to mount cgroup2 filesystem on the underlying Kubernetes node.\n # We use nsenter command with host's cgroup and mount namespaces enabled.\n - name: mount-cgroup\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: CGROUP_ROOT\n value: /run/cilium/cgroupv2\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh and mount that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-mount /hostbin/cilium-mount;\n nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\n rm /hostbin/cilium-mount\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n - name: apply-sysctl-overwrites\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\n nsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\n rm /hostbin/cilium-sysctlfix\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n - name: clean-cilium-state\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - /init-container.sh\n env:\n - name: CILIUM_ALL_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-state\n optional: true\n - name: CILIUM_BPF_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-bpf-state\n optional: true\n - name: WRITE_CNI_CONF_WHEN_READY\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: write-cni-conf-when-ready\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Required to mount cgroup filesystem from the host to cilium agent pod\n - name: cilium-cgroup\n mountPath: /run/cilium/cgroupv2\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium # wait-for-kube-proxy\n # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent\n - name: install-cni-binaries\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - \"/install-plugin.sh\"\n resources:\n requests:\n cpu: 100m\n memory: 10Mi\n securityContext:\n privileged: true\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: cni-path\n mountPath: /host/opt/cni/bin # .Values.cni.install\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # For sharing configuration between the \"config\" initContainer and the agent\n - name: tmp\n emptyDir: {}\n # To keep state between restarts / upgrades\n - name: cilium-run\n hostPath:\n path: /var/run/cilium\n type: DirectoryOrCreate\n # To exec into pod network namespaces\n - name: cilium-netns\n hostPath:\n path: /var/run/netns\n type: DirectoryOrCreate\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n # To mount cgroup2 filesystem on the host or apply sysctlfix\n - name: hostproc\n hostPath:\n path: /proc\n type: Directory\n # To keep state between restarts / upgrades for cgroup2 filesystem\n - name: cilium-cgroup\n hostPath:\n path: /run/cilium/cgroupv2\n type: DirectoryOrCreate\n # To install cilium cni plugin in the host\n - name: cni-path\n hostPath:\n path: /opt/cni/bin\n type: DirectoryOrCreate\n # To install cilium cni configuration in the host\n - name: etc-cni-netd\n hostPath:\n path: /etc/cni/net.d\n type: DirectoryOrCreate\n # To be able to load kernel modules\n - name: lib-modules\n hostPath:\n path: /lib/modules\n # To access iptables concurrently with other processes (e.g. kube-proxy)\n - name: xtables-lock\n hostPath:\n path: /run/xtables.lock\n type: FileOrCreate\n # Sharing socket with Cilium Envoy on the same node by using a host path\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n # To read the clustermesh configuration\n - name: clustermesh-secrets\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: cilium-clustermesh\n optional: true\n # note: items are not explicitly listed here, since the entries of this secret\n # depend on the peers configured, and that would cause a restart of all agents\n # at every addition/removal. Leaving the field empty makes each secret entry\n # to be automatically projected into the volume as a file whose name is the key.\n - secret:\n name: clustermesh-apiserver-remote-cert\n optional: true\n items:\n - key: tls.key\n path: common-etcd-client.key\n - key: tls.crt\n path: common-etcd-client.crt\n - key: ca.crt\n path: common-etcd-client-ca.crt\n # note: we configure the volume for the kvstoremesh-specific certificate\n # regardless of whether KVStoreMesh is enabled or not, so that it can be\n # automatically mounted in case KVStoreMesh gets subsequently enabled,\n # without requiring an agent restart.\n - secret:\n name: clustermesh-apiserver-local-cert\n optional: true\n items:\n - key: tls.key\n path: local-etcd-client.key\n - key: tls.crt\n path: local-etcd-client.crt\n - key: ca.crt\n path: local-etcd-client-ca.crt\n - name: hubble-tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-server-certs\n optional: true\n items:\n - key: tls.crt\n path: server.crt\n - key: tls.key\n path: server.key\n - key: ca.crt\n path: client-ca.crt\n---\n# Source: cilium/templates/cilium-envoy/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-envoy\n name: cilium-envoy\nspec:\n selector:\n matchLabels:\n k8s-app: cilium-envoy\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium-envoy\n name: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-envoy\n image: \"quay.io/cilium/cilium-envoy:v1.31.5-1741765102-efed3defcc70ab5b263a0fc44c93d316b846a211@sha256:377c78c13d2731f3720f931721ee309159e782d882251709cb0fac3b42c03f4b\"\n imagePullPolicy: IfNotPresent\n command:\n - /usr/bin/cilium-envoy-starter\n args:\n - '--'\n - '-c /var/run/cilium/envoy/bootstrap-config.json'\n - '--base-id 0'\n - '--log-level info'\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: envoy-metrics\n containerPort: 9964\n hostPort: 9964\n protocol: TCP\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_ADMIN\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: envoy-artifacts\n mountPath: /var/run/cilium/envoy/artifacts\n readOnly: true\n - name: envoy-config\n mountPath: /var/run/cilium/envoy/\n readOnly: true\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: HostToContainer\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium-envoy\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: cilium.io/no-schedule\n operator: NotIn\n values:\n - \"true\"\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium-envoy\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n - name: envoy-artifacts\n hostPath:\n path: \"/var/run/cilium/envoy/artifacts\"\n type: DirectoryOrCreate\n - name: envoy-config\n configMap:\n name: \"cilium-envoy-config\"\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n items:\n - key: bootstrap-config.json\n path: bootstrap-config.json\n # To keep state between restarts / upgrades\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n---\n# Source: cilium/templates/cilium-operator/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cilium-operator\n namespace: kube-system\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\nspec:\n # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go\n # for more details.\n replicas: 2\n selector:\n matchLabels:\n io.cilium/app: operator\n name: cilium-operator\n # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case\n # of one replica and no user configured Recreate strategy.\n # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the\n # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.\n strategy:\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 50%\n type: RollingUpdate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"9963\"\n prometheus.io/scrape: \"true\"\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\n spec:\n containers:\n - name: cilium-operator\n image: \"quay.io/cilium/operator-generic:v1.17.2@sha256:81f2d7198366e8dec2903a3a8361e4c68d47d19c68a0d42f0b7b6e3f0523f249\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-operator-generic\n args:\n - --config-dir=/tmp/cilium/config-map\n - --debug=$(CILIUM_DEBUG)\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_DEBUG\n valueFrom:\n configMapKeyRef:\n key: debug\n name: cilium-config\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: prometheus\n containerPort: 9963\n hostPort: 9963\n protocol: TCP\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 3\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 0\n periodSeconds: 5\n timeoutSeconds: 3\n failureThreshold: 5\n volumeMounts:\n - name: cilium-config-path\n mountPath: /tmp/cilium/config-map\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n hostNetwork: true\n restartPolicy: Always\n priorityClassName: system-cluster-critical\n serviceAccountName: \"cilium-operator\"\n automountServiceAccountToken: true\n # In HA mode, cilium-operator pods must not be scheduled on the same\n # node as they will clash with each other.\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n io.cilium/app: operator\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # To read the configuration from the config map\n - name: cilium-config-path\n configMap:\n name: cilium-config\n---\n# Source: cilium/templates/hubble-relay/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: hubble-relay\n namespace: kube-system\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-relay\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 65532\n containers:\n - name: hubble-relay\n securityContext:\n capabilities:\n drop:\n - ALL\n runAsGroup: 65532\n runAsNonRoot: true\n runAsUser: 65532\n image: \"quay.io/cilium/hubble-relay:v1.17.2@sha256:42a8db5c256c516cacb5b8937c321b2373ad7a6b0a1e5a5120d5028433d586cc\"\n imagePullPolicy: IfNotPresent\n command:\n - hubble-relay\n args:\n - serve\n ports:\n - name: grpc\n containerPort: 4245\n readinessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 3\n # livenessProbe will kill the pod, we should be very conservative\n # here on failures since killing the pod should be a last resort, and\n # we should provide enough time for relay to retry before killing it.\n livenessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 10\n # Give relay time to establish connections and make a few retries\n # before starting livenessProbes.\n initialDelaySeconds: 10\n # 10 second * 12 failures = 2 minutes of failure.\n # If relay cannot become healthy after 2 minutes, then killing it\n # might resolve whatever issue is occurring.\n #\n # 10 seconds is a reasonable retry period so we can see if it's\n # failing regularly or only sporadically.\n periodSeconds: 10\n failureThreshold: 12\n startupProbe:\n grpc:\n port: 4222\n # Give relay time to get it's certs and establish connections and\n # make a few retries before starting startupProbes.\n initialDelaySeconds: 10\n # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.\n failureThreshold: 20\n # Retry more frequently at startup so that it can be considered started more quickly.\n periodSeconds: 3\n volumeMounts:\n - name: config\n mountPath: /etc/hubble-relay\n readOnly: true\n - name: tls\n mountPath: /var/lib/hubble-relay/tls\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n \n restartPolicy: Always\n priorityClassName: \n serviceAccountName: \"hubble-relay\"\n automountServiceAccountToken: false\n terminationGracePeriodSeconds: 1\n affinity:\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - name: config\n configMap:\n name: hubble-relay-config\n items:\n - key: config.yaml\n path: config.yaml\n - name: tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-relay-client-certs\n items:\n - key: tls.crt\n path: client.crt\n - key: tls.key\n path: client.key\n - key: ca.crt\n path: hubble-server-ca.crt\n---\n# Source: cilium/templates/hubble-ui/deployment.yaml\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-ui\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 1001\n runAsGroup: 1001\n runAsUser: 1001\n priorityClassName: \n serviceAccountName: \"hubble-ui\"\n automountServiceAccountToken: true\n containers:\n - name: frontend\n image: \"quay.io/cilium/hubble-ui:v0.13.2@sha256:9e37c1296b802830834cc87342a9182ccbb71ffebb711971e849221bd9d59392\"\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8081\n livenessProbe:\n httpGet:\n path: /healthz\n port: 8081\n readinessProbe:\n httpGet:\n path: /\n port: 8081\n volumeMounts:\n - name: hubble-ui-nginx-conf\n mountPath: /etc/nginx/conf.d/default.conf\n subPath: nginx.conf\n - name: tmp-dir\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n - name: backend\n image: \"quay.io/cilium/hubble-ui-backend:v0.13.2@sha256:a034b7e98e6ea796ed26df8f4e71f83fc16465a19d166eff67a03b822c0bfa15\"\n imagePullPolicy: IfNotPresent\n env:\n - name: EVENTS_SERVER_PORT\n value: \"8090\"\n - name: FLOWS_API_ADDR\n value: \"hubble-relay:80\"\n ports:\n - name: grpc\n containerPort: 8090\n volumeMounts:\n terminationMessagePolicy: FallbackToLogsOnError\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - configMap:\n defaultMode: 420\n name: hubble-ui-nginx\n name: hubble-ui-nginx-conf\n - emptyDir: {}\n name: tmp-dir\n" + # Argo CD reconciliation service account (unraid-lab's Argo attaches here). + # Token is generated POST-bootstrap and stored in Bitwarden — never committed. + - name: argocd-manager contents: | - apiVersion: v1 - kind: Namespace - metadata: - name: argocd - --- - apiVersion: apiextensions.k8s.io/v1 - kind: CustomResourceDefinition - metadata: - labels: - app.kubernetes.io/name: applications.argoproj.io - app.kubernetes.io/part-of: argocd - name: applications.argoproj.io - spec: - group: argoproj.io - names: - kind: Application - listKind: ApplicationList - plural: applications - shortNames: - - app - - apps - singular: application - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.sync.status - name: Sync Status - type: string - - jsonPath: .status.health.status - name: Health Status - type: string - - jsonPath: .status.sync.revision - name: Revision - priority: 10 - type: string - - jsonPath: .spec.project - name: Project - priority: 10 - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: Application is a definition of Application resource. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - operation: - description: Operation contains information about a requested or running - operation - properties: - info: - description: Info is a list of informational items for this operation - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - initiatedBy: - description: InitiatedBy contains information about who initiated - the operations - properties: - automated: - description: Automated is set to true if operation was initiated - automatically by the application controller. - type: boolean - username: - description: Username contains the name of a user who started - operation - type: string - type: object - retry: - description: Retry controls the strategy to apply if a sync fails - properties: - backoff: - description: Backoff controls how to backoff on subsequent retries - of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default unit - is seconds, but could also be a duration (e.g. "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base duration - after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of time allowed - for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for retrying - a failed sync. If set to 0, no retries will be performed. - format: int64 - type: integer - type: object - sync: - description: Sync contains parameters for the operation - properties: - autoHealAttemptsCount: - description: SelfHealAttemptsCount contains the number of auto-heal - attempts - format: int64 - type: integer - dryRun: - description: DryRun specifies to perform a `kubectl apply --dry-run` - without actually performing the sync - type: boolean - manifests: - description: Manifests is an optional field that overrides sync - source with a local directory for development - items: - type: string - type: array - prune: - description: Prune specifies to delete resources from the cluster - that are no longer tracked in git - type: boolean - resources: - description: Resources describes which resources shall be part - of the sync - items: - description: SyncOperationResource contains resources to sync. - properties: - group: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - type: array - revision: - description: |- - Revision is the revision (Git) or chart version (Helm) which to sync the application to - If omitted, will use the revision specified in app spec. - type: string - revisions: - description: |- - Revisions is the list of revision (Git) or chart version (Helm) which to sync each source in sources field for the application to - If omitted, will use the revision specified in app spec. - items: - type: string - type: array - source: - description: |- - Source overrides the source definition set in the application. - This is typically set in a Rollback operation and is nil during a Sync operation - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable to - be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to - be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by - not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to template - with. If left empty, defaults to the app's destination - namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest - generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema validation - (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. ValuesObject - takes precedence over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to be - passed to helm template, defined as a map. This takes - precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources for - Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether to - apply common labels to resource selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is displayed - in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type - parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: |- - Sources overrides the source definition set in the application. - This is typically set in a Rollback operation and is nil during a Sync operation - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally - by not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to template - with. If left empty, defaults to the app's destination - namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to - tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to - use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. ValuesObject - takes precedence over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to be - passed to helm template, defined as a map. This takes - precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is displayed - in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncOptions: - description: SyncOptions provide per-sync sync-options, e.g. Validate=false - items: - type: string - type: array - syncStrategy: - description: SyncStrategy describes how to perform the sync - properties: - apply: - description: Apply will perform a `kubectl apply` to perform - the sync. - properties: - force: - description: |- - Force indicates whether or not to supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, when PATCH encounters conflict and has - retried for 5 times. - type: boolean - type: object - hook: - description: Hook will submit any referenced resources to - perform the sync. This is the default strategy - properties: - force: - description: |- - Force indicates whether or not to supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, when PATCH encounters conflict and has - retried for 5 times. - type: boolean - type: object - type: object - type: object - type: object - spec: - description: ApplicationSpec represents desired application state. Contains - link to repository with application definition and additional parameters - link definition revision. - properties: - destination: - description: Destination is a reference to the target Kubernetes server - and namespace - properties: - name: - description: Name is an alternate way of specifying the target - cluster by its symbolic name. This must be set if Server is - not set. - type: string - namespace: - description: |- - Namespace specifies the target namespace for the application's resources. - The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster's - Kubernetes control plane API. This must be set if Name is not - set. - type: string - type: object - ignoreDifferences: - description: IgnoreDifferences is a list of resources and their fields - which should be ignored during comparison - items: - description: ResourceIgnoreDifferences contains resource filter - and list of json paths which should be ignored during comparison - with live state. - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - description: |- - ManagedFieldsManagers is a list of trusted managers. Fields mutated by those managers will take precedence over the - desired state defined in the SCM and won't be displayed in diffs - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - description: Info contains a list of information (URLs, email addresses, - and plain text) that relates to the application - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - description: |- - Project is a reference to the project this application belongs to. - The empty string means that application belongs to the 'default' project. - type: string - revisionHistoryLimit: - description: |- - RevisionHistoryLimit limits the number of items kept in the application's revision history, which is used for informational purposes as well as for rollbacks to previous versions. - This should only be changed in exceptional circumstances. - Setting to zero will store no history. This will reduce storage used. - Increasing will increase the space used to store the history, so we do not recommend increasing it. - Default is 10. - format: int64 - type: integer - source: - description: Source is a reference to the location of the application's - manifests or chart - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match paths - against that should be explicitly excluded from being used - during manifest generation - type: string - include: - description: Include contains a glob pattern to match paths - against that should be explicitly included during manifest - generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External Variables - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to the helm - template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by not - appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to template - with. If left empty, defaults to the app's destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition installation - step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema validation - (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation step - (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files to - use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed to - helm template, typically defined as a block. ValuesObject - takes precedence over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to be passed - to helm template, defined as a map. This takes precedence - over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional annotations - to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether to - apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels to - add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize components - to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether to force - applying common annotations to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether to apply - common labels to resource selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize adds - to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas override - specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize to - use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is displayed - in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or Helm) - that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sourceHydrator: - description: SourceHydrator provides a way to push hydrated manifests - back to git before syncing them to the cluster. - properties: - drySource: - description: DrySource specifies where the dry "don't repeat yourself" - manifest source lives. - properties: - path: - description: Path is a directory path within the Git repository - where the manifests are located - type: string - repoURL: - description: RepoURL is the URL to the git repository that - contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of the source - to hydrate - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - description: |- - HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then - have to move manifests to the SyncSource, e.g. by pull request. - properties: - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - targetBranch - type: object - syncSource: - description: SyncSource specifies where to sync hydrated manifests - from. - properties: - path: - description: |- - Path is a directory path within the git repository where hydrated manifests should be committed to and synced - from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced. - type: string - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - description: Sources is a reference to the location of the application's - manifests or chart - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match paths - against that should be explicitly excluded from being - used during manifest generation - type: string - include: - description: Include contains a glob pattern to match paths - against that should be explicitly included during manifest - generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External Variables - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level Arguments - items: - description: JsonnetVar represents a variable to be - passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to the helm - template - items: - description: HelmFileParameter is a file parameter that's - passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally by not - appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to template - with. If left empty, defaults to the app's destination - namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters which - are passed to the helm template command upon manifest - generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to tell - Helm to interpret booleans and numbers as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all domains - (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to use. - If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition installation - step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema validation - (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files to - use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed to - helm template, typically defined as a block. ValuesObject - takes precedence over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to be passed - to helm template, defined as a map. This takes precedence - over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for templating - ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional annotations - to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize components - to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether to - force applying common annotations to resources for Kustomize - apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to force - applying common labels to resources for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize image - definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether to apply - common labels to resource selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas override - specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is displayed - in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, usually - expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string type - parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or Helm) - that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - description: SyncPolicy controls when and how a sync will be performed - properties: - automated: - description: Automated will keep an application synced to the - target revision - properties: - allowEmpty: - description: 'AllowEmpty allows apps have zero live resources - (default: false)' - type: boolean - prune: - description: 'Prune specifies whether to delete resources - from the cluster that are not found in the sources anymore - as part of automated sync (default: false)' - type: boolean - selfHeal: - description: 'SelfHeal specifies whether to revert resources - back to their desired state upon modification in the cluster - (default: false)' - type: boolean - type: object - managedNamespaceMetadata: - description: ManagedNamespaceMetadata controls metadata in the - given namespace (if CreateNamespace=true) - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - description: Retry controls failed sync retry behavior - properties: - backoff: - description: Backoff controls how to backoff on subsequent - retries of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default - unit is seconds, but could also be a duration (e.g. - "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base duration - after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of time - allowed for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for retrying - a failed sync. If set to 0, no retries will be performed. - format: int64 - type: integer - type: object - syncOptions: - description: Options allow you to specify whole app sync-options - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - status: - description: ApplicationStatus contains status information for the application - properties: - conditions: - description: Conditions is a list of currently observed application - conditions - items: - description: ApplicationCondition contains details about an application - condition, which is usually an error or warning - properties: - lastTransitionTime: - description: LastTransitionTime is the time the condition was - last observed - format: date-time - type: string - message: - description: Message contains human-readable message indicating - details about condition - type: string - type: - description: Type is an application condition type - type: string - required: - - message - - type - type: object - type: array - controllerNamespace: - description: ControllerNamespace indicates the namespace in which - the application controller is located - type: string - health: - description: Health contains information about the application's current - health status - properties: - lastTransitionTime: - description: LastTransitionTime is the time the HealthStatus was - set or updated - format: date-time - type: string - message: - description: Message is a human-readable informational message - describing the health status - type: string - status: - description: Status holds the status code of the application or - resource - type: string - type: object - history: - description: History contains information about the application's - sync history - items: - description: RevisionHistory contains history information about - a previous sync - properties: - deployStartedAt: - description: DeployStartedAt holds the time the sync operation - started - format: date-time - type: string - deployedAt: - description: DeployedAt holds the time the sync operation completed - format: date-time - type: string - id: - description: ID is an auto incrementing identifier of the RevisionHistory - format: int64 - type: integer - initiatedBy: - description: InitiatedBy contains information about who initiated - the operations - properties: - automated: - description: Automated is set to true if operation was initiated - automatically by the application controller. - type: boolean - username: - description: Username contains the name of a user who started - operation - type: string - type: object - revision: - description: Revision holds the revision the sync was performed - against - type: string - revisions: - description: Revisions holds the revision of each source in - sources field the sync was performed against - items: - type: string - type: array - source: - description: Source is a reference to the application source - used for the sync operation - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded from - being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included during - manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to the - helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm template - from failing when valueFiles do not exist locally - by not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to template - with. If left empty, defaults to the app's destination - namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's passed - to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether to - tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name to - use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. ValuesObject - takes precedence over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to be - passed to helm template, defined as a map. This takes - precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional labels - to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is displayed - in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable entries - items: - description: EnvEntry represents an entry in the application's - environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array type - parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type parameter. - type: object - name: - description: Name is the name identifying a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within sources - field. This field will not be used if used with a `source` - tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git or - Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources is a reference to the application sources - used for the sync operation - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to - template with. If left empty, defaults to the app's - destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. - ValuesObject takes precedence over Values, so use - one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to - be passed to helm template, defined as a map. This - takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or - not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is - displayed in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - deployedAt - - id - type: object - type: array - observedAt: - description: |- - ObservedAt indicates when the application state was updated without querying latest git state - Deprecated: controller no longer updates ObservedAt field - format: date-time - type: string - operationState: - description: OperationState contains information about any ongoing - operations, such as a sync - properties: - finishedAt: - description: FinishedAt contains time of operation completion - format: date-time - type: string - message: - description: Message holds any pertinent messages when attempting - to perform operation (typically errors). - type: string - operation: - description: Operation is the original requested operation - properties: - info: - description: Info is a list of informational items for this - operation - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - initiatedBy: - description: InitiatedBy contains information about who initiated - the operations - properties: - automated: - description: Automated is set to true if operation was - initiated automatically by the application controller. - type: boolean - username: - description: Username contains the name of a user who - started operation - type: string - type: object - retry: - description: Retry controls the strategy to apply if a sync - fails - properties: - backoff: - description: Backoff controls how to backoff on subsequent - retries of failed syncs - properties: - duration: - description: Duration is the amount to back off. Default - unit is seconds, but could also be a duration (e.g. - "2m", "1h") - type: string - factor: - description: Factor is a factor to multiply the base - duration after each failed retry - format: int64 - type: integer - maxDuration: - description: MaxDuration is the maximum amount of - time allowed for the backoff strategy - type: string - type: object - limit: - description: Limit is the maximum number of attempts for - retrying a failed sync. If set to 0, no retries will - be performed. - format: int64 - type: integer - type: object - sync: - description: Sync contains parameters for the operation - properties: - autoHealAttemptsCount: - description: SelfHealAttemptsCount contains the number - of auto-heal attempts - format: int64 - type: integer - dryRun: - description: DryRun specifies to perform a `kubectl apply - --dry-run` without actually performing the sync - type: boolean - manifests: - description: Manifests is an optional field that overrides - sync source with a local directory for development - items: - type: string - type: array - prune: - description: Prune specifies to delete resources from - the cluster that are no longer tracked in git - type: boolean - resources: - description: Resources describes which resources shall - be part of the sync - items: - description: SyncOperationResource contains resources - to sync. - properties: - group: - type: string - kind: - type: string - name: - type: string - namespace: - type: string - required: - - kind - - name - type: object - type: array - revision: - description: |- - Revision is the revision (Git) or chart version (Helm) which to sync the application to - If omitted, will use the revision specified in app spec. - type: string - revisions: - description: |- - Revisions is the list of revision (Git) or chart version (Helm) which to sync each source in sources field for the application to - If omitted, will use the revision specified in app spec. - items: - type: string - type: array - source: - description: |- - Source overrides the source definition set in the application. - This is typically set in a Rollback operation and is nil during a Sync operation - properties: - chart: - description: Chart is a Helm chart name, and must - be specified for applications sourced from a Helm - repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to - Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet - External Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan - a directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents - helm template from failing when valueFiles do - not exist locally by not appending them to helm - template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace - to template with. If left empty, defaults to - the app's destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and - numbers as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the - Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials - to all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block. ValuesObject takes precedence over - Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values - to be passed to helm template, defined as a - map. This takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution - for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before - building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies - whether to force applying common annotations - to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources - for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors - or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that - Kustomize adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of - Kustomize to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and - is displayed in the UI. It is used in multi-source - Applications. - type: string - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin - specific options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in - the application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository - (Git or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: |- - Sources overrides the source definition set in the application. - This is typically set in a Rollback operation and is nil during a Sync operation - items: - description: ApplicationSource contains all required - information about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must - be specified for applications sourced from a Helm - repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern - to match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern - to match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific - to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet - External Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan - a directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents - helm template from failing when valueFiles - do not exist locally by not appending them - to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace - to template with. If left empty, defaults - to the app's destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter - that's passed to helm template during manifest - generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and - numbers as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the - Helm parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials - to all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release - name to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource - definition installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON - schema validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to - be passed to helm template, typically defined - as a block. ValuesObject takes precedence - over Values, so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values - to be passed to helm template, defined as - a map. This takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to - use for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific - options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of - additional annotations to add to rendered - manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution - for annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of - kustomize components to add to the kustomization - before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies - whether to force applying common annotations - to resources for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources - for Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies - whether to apply common labels to resource - selectors or not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended - to resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended - to resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that - Kustomize adds to all resources - type: string - patches: - description: Patches is a list of Kustomize - patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize - Replicas override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version - of Kustomize to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and - is displayed in the UI. It is used in multi-source - Applications. - type: string - path: - description: Path is a directory path within the - Git repository, and is only valid for applications - sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin - specific options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry - in the application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the - variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an - array type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map - type parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a - string type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source - within sources field. This field will not be used - if used with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository - (Git or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - syncOptions: - description: SyncOptions provide per-sync sync-options, - e.g. Validate=false - items: - type: string - type: array - syncStrategy: - description: SyncStrategy describes how to perform the - sync - properties: - apply: - description: Apply will perform a `kubectl apply` - to perform the sync. - properties: - force: - description: |- - Force indicates whether or not to supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, when PATCH encounters conflict and has - retried for 5 times. - type: boolean - type: object - hook: - description: Hook will submit any referenced resources - to perform the sync. This is the default strategy - properties: - force: - description: |- - Force indicates whether or not to supply the --force flag to `kubectl apply`. - The --force flag deletes and re-create the resource, when PATCH encounters conflict and has - retried for 5 times. - type: boolean - type: object - type: object - type: object - type: object - phase: - description: Phase is the current phase of the operation - type: string - retryCount: - description: RetryCount contains time of operation retries - format: int64 - type: integer - startedAt: - description: StartedAt contains time of operation start - format: date-time - type: string - syncResult: - description: SyncResult is the result of a Sync operation - properties: - managedNamespaceMetadata: - description: ManagedNamespaceMetadata contains the current - sync state of managed namespace metadata - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - resources: - description: Resources contains a list of sync result items - for each individual resource in a sync operation - items: - description: ResourceResult holds the operation result details - of a specific resource - properties: - group: - description: Group specifies the API group of the resource - type: string - hookPhase: - description: |- - HookPhase contains the state of any operation associated with this resource OR hook - This can also contain values for non-hook resources. - type: string - hookType: - description: HookType specifies the type of the hook. - Empty for non-hook resources - type: string - kind: - description: Kind specifies the API kind of the resource - type: string - message: - description: Message contains an informational or error - message for the last sync OR operation - type: string - name: - description: Name specifies the name of the resource - type: string - namespace: - description: Namespace specifies the target namespace - of the resource - type: string - status: - description: Status holds the final result of the sync. - Will be empty if the resources is yet to be applied/pruned - and is always zero-value for hooks - type: string - syncPhase: - description: SyncPhase indicates the particular phase - of the sync that this result was acquired in - type: string - version: - description: Version specifies the API version of the - resource - type: string - required: - - group - - kind - - name - - namespace - - version - type: object - type: array - revision: - description: Revision holds the revision this sync operation - was performed to - type: string - revisions: - description: Revisions holds the revision this sync operation - was performed for respective indexed source in sources field - items: - type: string - type: array - source: - description: Source records the application source information - of the sync, used for comparing auto-sync - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to - template with. If left empty, defaults to the app's - destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. - ValuesObject takes precedence over Values, so use - one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to - be passed to helm template, defined as a map. This - takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or - not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is - displayed in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Source records the application source information - of the sync, used for comparing auto-sync - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be - specified for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a - directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template - --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace - to template with. If left empty, defaults to the - app's destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to - all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block. ValuesObject takes precedence over Values, - so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values - to be passed to helm template, defined as a map. - This takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution for - annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before - building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources for - Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or - not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is - displayed in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - revision - type: object - required: - - operation - - phase - - startedAt - type: object - reconciledAt: - description: ReconciledAt indicates when the application state was - reconciled using the latest git version - format: date-time - type: string - resourceHealthSource: - description: 'ResourceHealthSource indicates where the resource health - status is stored: inline if not set or appTree' - type: string - resources: - description: Resources is a list of Kubernetes resources managed by - this application - items: - description: |- - ResourceStatus holds the current sync and health status of a resource - TODO: describe members of this type - properties: - group: - type: string - health: - description: HealthStatus contains information about the currently - observed health state of an application or resource - properties: - lastTransitionTime: - description: LastTransitionTime is the time the HealthStatus - was set or updated - format: date-time - type: string - message: - description: Message is a human-readable informational message - describing the health status - type: string - status: - description: Status holds the status code of the application - or resource - type: string - type: object - hook: - type: boolean - kind: - type: string - name: - type: string - namespace: - type: string - requiresDeletionConfirmation: - type: boolean - requiresPruning: - type: boolean - status: - description: SyncStatusCode is a type which represents possible - comparison results - type: string - syncWave: - format: int64 - type: integer - version: - type: string - type: object - type: array - sourceHydrator: - description: SourceHydrator stores information about the current state - of source hydration - properties: - currentOperation: - description: CurrentOperation holds the status of the hydrate - operation - properties: - drySHA: - description: DrySHA holds the resolved revision (sha) of the - dry source as of the most recent reconciliation - type: string - finishedAt: - description: FinishedAt indicates when the hydrate operation - finished - format: date-time - type: string - hydratedSHA: - description: HydratedSHA holds the resolved revision (sha) - of the hydrated source as of the most recent reconciliation - type: string - message: - description: Message contains a message describing the current - status of the hydrate operation - type: string - phase: - description: Phase indicates the status of the hydrate operation - enum: - - Hydrating - - Failed - - Hydrated - type: string - sourceHydrator: - description: SourceHydrator holds the hydrator config used - for the hydrate operation - properties: - drySource: - description: DrySource specifies where the dry "don't - repeat yourself" manifest source lives. - properties: - path: - description: Path is a directory path within the Git - repository where the manifests are located - type: string - repoURL: - description: RepoURL is the URL to the git repository - that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of - the source to hydrate - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - description: |- - HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then - have to move manifests to the SyncSource, e.g. by pull request. - properties: - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - targetBranch - type: object - syncSource: - description: SyncSource specifies where to sync hydrated - manifests from. - properties: - path: - description: |- - Path is a directory path within the git repository where hydrated manifests should be committed to and synced - from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced. - type: string - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - startedAt: - description: StartedAt indicates when the hydrate operation - started - format: date-time - type: string - required: - - message - - phase - type: object - lastSuccessfulOperation: - description: LastSuccessfulOperation holds info about the most - recent successful hydration - properties: - drySHA: - description: DrySHA holds the resolved revision (sha) of the - dry source as of the most recent reconciliation - type: string - hydratedSHA: - description: HydratedSHA holds the resolved revision (sha) - of the hydrated source as of the most recent reconciliation - type: string - sourceHydrator: - description: SourceHydrator holds the hydrator config used - for the hydrate operation - properties: - drySource: - description: DrySource specifies where the dry "don't - repeat yourself" manifest source lives. - properties: - path: - description: Path is a directory path within the Git - repository where the manifests are located - type: string - repoURL: - description: RepoURL is the URL to the git repository - that contains the application manifests - type: string - targetRevision: - description: TargetRevision defines the revision of - the source to hydrate - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - description: |- - HydrateTo specifies an optional "staging" location to push hydrated manifests to. An external system would then - have to move manifests to the SyncSource, e.g. by pull request. - properties: - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - targetBranch - type: object - syncSource: - description: SyncSource specifies where to sync hydrated - manifests from. - properties: - path: - description: |- - Path is a directory path within the git repository where hydrated manifests should be committed to and synced - from. If hydrateTo is set, this is just the path from which hydrated manifests will be synced. - type: string - targetBranch: - description: TargetBranch is the branch to which hydrated - manifests should be committed - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - type: object - type: object - sourceType: - description: SourceType specifies the type of this application - type: string - sourceTypes: - description: SourceTypes specifies the type of the sources included - in the application - items: - description: ApplicationSourceType specifies the type of the application's - source - type: string - type: array - summary: - description: Summary contains a list of URLs and container images - used by this application - properties: - externalURLs: - description: ExternalURLs holds all external URLs of application - child resources. - items: - type: string - type: array - images: - description: Images holds all images of application child resources. - items: - type: string - type: array - type: object - sync: - description: Sync contains information about the application's current - sync status - properties: - comparedTo: - description: ComparedTo contains information about what has been - compared - properties: - destination: - description: Destination is a reference to the application's - destination used for comparison - properties: - name: - description: Name is an alternate way of specifying the - target cluster by its symbolic name. This must be set - if Server is not set. - type: string - namespace: - description: |- - Namespace specifies the target namespace for the application's resources. - The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster's - Kubernetes control plane API. This must be set if Name - is not set. - type: string - type: object - ignoreDifferences: - description: IgnoreDifferences is a reference to the application's - ignored differences used for comparison - items: - description: ResourceIgnoreDifferences contains resource - filter and list of json paths which should be ignored - during comparison with live state. - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - description: |- - ManagedFieldsManagers is a list of trusted managers. Fields mutated by those managers will take precedence over the - desired state defined in the SCM and won't be displayed in diffs - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - source: - description: Source is a reference to the application's source - used for comparison - properties: - chart: - description: Chart is a Helm chart name, and must be specified - for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific options - properties: - exclude: - description: Exclude contains a glob pattern to match - paths against that should be explicitly excluded - from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to match - paths against that should be explicitly included - during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a directory - recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters to - the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm parameter - type: string - path: - description: Path is the path to the file containing - the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace to - template with. If left empty, defaults to the app's - destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command upon - manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to all - domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value files - to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be passed - to helm template, typically defined as a block. - ValuesObject takes precedence over Values, so use - one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values to - be passed to helm template, defined as a map. This - takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use for - templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies whether - to apply env variables substitution for annotation - values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether to - force applying common labels to resources for Kustomize - apps - type: boolean - images: - description: Images is a list of Kustomize image override - specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or - not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to resources - for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to resources - for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is - displayed in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git repository, - and is only valid for applications sourced from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying a - parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used with - a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - sources: - description: Sources is a reference to the application's multiple - sources used for comparison - items: - description: ApplicationSource contains all required information - about the source of an application - properties: - chart: - description: Chart is a Helm chart name, and must be - specified for applications sourced from a Helm repo. - type: string - directory: - description: Directory holds path/directory specific - options - properties: - exclude: - description: Exclude contains a glob pattern to - match paths against that should be explicitly - excluded from being used during manifest generation - type: string - include: - description: Include contains a glob pattern to - match paths against that should be explicitly - included during manifest generation - type: string - jsonnet: - description: Jsonnet holds options specific to Jsonnet - properties: - extVars: - description: ExtVars is a list of Jsonnet External - Variables - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - description: Additional library search dirs - items: - type: string - type: array - tlas: - description: TLAS is a list of Jsonnet Top-level - Arguments - items: - description: JsonnetVar represents a variable - to be passed to jsonnet during manifest - generation - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - description: Recurse specifies whether to scan a - directory recursively for manifests - type: boolean - type: object - helm: - description: Helm holds helm specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - fileParameters: - description: FileParameters are file parameters - to the helm template - items: - description: HelmFileParameter is a file parameter - that's passed to helm template during manifest - generation - properties: - name: - description: Name is the name of the Helm - parameter - type: string - path: - description: Path is the path to the file - containing the values for the Helm parameter - type: string - type: object - type: array - ignoreMissingValueFiles: - description: IgnoreMissingValueFiles prevents helm - template from failing when valueFiles do not exist - locally by not appending them to helm template - --values - type: boolean - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - namespace: - description: Namespace is an optional namespace - to template with. If left empty, defaults to the - app's destination namespace. - type: string - parameters: - description: Parameters is a list of Helm parameters - which are passed to the helm template command - upon manifest generation - items: - description: HelmParameter is a parameter that's - passed to helm template during manifest generation - properties: - forceString: - description: ForceString determines whether - to tell Helm to interpret booleans and numbers - as strings - type: boolean - name: - description: Name is the name of the Helm - parameter - type: string - value: - description: Value is the value for the Helm - parameter - type: string - type: object - type: array - passCredentials: - description: PassCredentials pass credentials to - all domains (Helm's --pass-credentials) - type: boolean - releaseName: - description: ReleaseName is the Helm release name - to use. If omitted it will use the application - name - type: string - skipCrds: - description: SkipCrds skips custom resource definition - installation step (Helm's --skip-crds) - type: boolean - skipSchemaValidation: - description: SkipSchemaValidation skips JSON schema - validation (Helm's --skip-schema-validation) - type: boolean - skipTests: - description: SkipTests skips test manifest installation - step (Helm's --skip-tests). - type: boolean - valueFiles: - description: ValuesFiles is a list of Helm value - files to use when generating a template - items: - type: string - type: array - values: - description: Values specifies Helm values to be - passed to helm template, typically defined as - a block. ValuesObject takes precedence over Values, - so use one or the other. - type: string - valuesObject: - description: ValuesObject specifies Helm values - to be passed to helm template, defined as a map. - This takes precedence over Values. - type: object - x-kubernetes-preserve-unknown-fields: true - version: - description: Version is the Helm version to use - for templating ("3") - type: string - type: object - kustomize: - description: Kustomize holds kustomize specific options - properties: - apiVersions: - description: |- - APIVersions specifies the Kubernetes resource API versions to pass to Helm when templating manifests. By default, - Argo CD uses the API versions of the target cluster. The format is [group/]version/kind. - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - description: CommonAnnotations is a list of additional - annotations to add to rendered manifests - type: object - commonAnnotationsEnvsubst: - description: CommonAnnotationsEnvsubst specifies - whether to apply env variables substitution for - annotation values - type: boolean - commonLabels: - additionalProperties: - type: string - description: CommonLabels is a list of additional - labels to add to rendered manifests - type: object - components: - description: Components specifies a list of kustomize - components to add to the kustomization before - building - items: - type: string - type: array - forceCommonAnnotations: - description: ForceCommonAnnotations specifies whether - to force applying common annotations to resources - for Kustomize apps - type: boolean - forceCommonLabels: - description: ForceCommonLabels specifies whether - to force applying common labels to resources for - Kustomize apps - type: boolean - images: - description: Images is a list of Kustomize image - override specifications - items: - description: KustomizeImage represents a Kustomize - image definition in the format [old_image_name=]: - type: string - type: array - kubeVersion: - description: |- - KubeVersion specifies the Kubernetes API version to pass to Helm when templating manifests. By default, Argo CD - uses the Kubernetes version of the target cluster. - type: string - labelWithoutSelector: - description: LabelWithoutSelector specifies whether - to apply common labels to resource selectors or - not - type: boolean - namePrefix: - description: NamePrefix is a prefix appended to - resources for Kustomize apps - type: string - nameSuffix: - description: NameSuffix is a suffix appended to - resources for Kustomize apps - type: string - namespace: - description: Namespace sets the namespace that Kustomize - adds to all resources - type: string - patches: - description: Patches is a list of Kustomize patches - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - description: Replicas is a list of Kustomize Replicas - override specifications - items: - properties: - count: - anyOf: - - type: integer - - type: string - description: Number of replicas - x-kubernetes-int-or-string: true - name: - description: Name of Deployment or StatefulSet - type: string - required: - - count - - name - type: object - type: array - version: - description: Version controls which version of Kustomize - to use for rendering manifests - type: string - type: object - name: - description: Name is used to refer to a source and is - displayed in the UI. It is used in multi-source Applications. - type: string - path: - description: Path is a directory path within the Git - repository, and is only valid for applications sourced - from Git. - type: string - plugin: - description: Plugin holds config management plugin specific - options - properties: - env: - description: Env is a list of environment variable - entries - items: - description: EnvEntry represents an entry in the - application's environment - properties: - name: - description: Name is the name of the variable, - usually expressed in uppercase - type: string - value: - description: Value is the value of the variable - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - description: Array is the value of an array - type parameter. - items: - type: string - type: array - map: - additionalProperties: - type: string - description: Map is the value of a map type - parameter. - type: object - name: - description: Name is the name identifying - a parameter. - type: string - string: - description: String_ is the value of a string - type parameter. - type: string - type: object - type: array - type: object - ref: - description: Ref is reference to another source within - sources field. This field will not be used if used - with a `source` tag. - type: string - repoURL: - description: RepoURL is the URL to the repository (Git - or Helm) that contains the application manifests - type: string - targetRevision: - description: |- - TargetRevision defines the revision of the source to sync the application to. - In case of Git, this can be commit, tag, or branch. If omitted, will equal to HEAD. - In case of Helm, this is a semver tag for the Chart's version. - type: string - required: - - repoURL - type: object - type: array - required: - - destination - type: object - revision: - description: Revision contains information about the revision - the comparison has been performed to - type: string - revisions: - description: Revisions contains information about the revisions - of multiple sources the comparison has been performed to - items: - type: string - type: array - status: - description: Status is the sync state of the comparison - type: string - required: - - status - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: {} - --- - apiVersion: apiextensions.k8s.io/v1 - kind: CustomResourceDefinition - metadata: - labels: - app.kubernetes.io/name: applicationsets.argoproj.io - app.kubernetes.io/part-of: argocd - name: applicationsets.argoproj.io - spec: - group: argoproj.io - names: - kind: ApplicationSet - listKind: ApplicationSetList - plural: applicationsets - shortNames: - - appset - - appsets - singular: applicationset - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - properties: - applyNestedSelectors: - type: boolean - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - flatList: - type: boolean - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - matrix: - properties: - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - flatList: - type: boolean - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - matrix: - x-kubernetes-preserve-unknown-fields: true - merge: - x-kubernetes-preserve-unknown-fields: true - plugin: - properties: - configMapRef: - properties: - name: - type: string - required: - - name - type: object - input: - properties: - parameters: - additionalProperties: - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - pullRequest: - properties: - azuredevops: - properties: - api: - type: string - labels: - items: - type: string - type: array - organization: - type: string - project: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - - project - - repo - type: object - bitbucket: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - owner: - type: string - repo: - type: string - required: - - owner - - repo - type: object - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - targetBranchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - awsCodeCommit: - properties: - allBranches: - type: boolean - region: - type: string - role: - type: string - tagFilters: - items: - properties: - key: - type: string - value: - type: string - required: - - key - type: object - type: array - type: object - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - group: - type: string - includeSharedProjects: - type: boolean - includeSubgroups: - type: boolean - insecure: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - topic: - type: string - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: array - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - generators - type: object - merge: - properties: - generators: - items: - properties: - clusterDecisionResource: - properties: - configMapRef: - type: string - labelSelector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - name: - type: string - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - clusters: - properties: - flatList: - type: boolean - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - git: - properties: - directories: - items: - properties: - exclude: - type: boolean - path: - type: string - required: - - path - type: object - type: array - files: - items: - properties: - path: - type: string - required: - - path - type: object - type: array - pathParamPrefix: - type: string - repoURL: - type: string - requeueAfterSeconds: - format: int64 - type: integer - revision: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - repoURL - - revision - type: object - list: - properties: - elements: - items: - x-kubernetes-preserve-unknown-fields: true - type: array - elementsYaml: - type: string - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - matrix: - x-kubernetes-preserve-unknown-fields: true - merge: - x-kubernetes-preserve-unknown-fields: true - plugin: - properties: - configMapRef: - properties: - name: - type: string - required: - - name - type: object - input: - properties: - parameters: - additionalProperties: - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - pullRequest: - properties: - azuredevops: - properties: - api: - type: string - labels: - items: - type: string - type: array - organization: - type: string - project: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - - project - - repo - type: object - bitbucket: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - owner: - type: string - repo: - type: string - required: - - owner - - repo - type: object - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - targetBranchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - awsCodeCommit: - properties: - allBranches: - type: boolean - region: - type: string - role: - type: string - tagFilters: - items: - properties: - key: - type: string - value: - type: string - required: - - key - type: object - type: array - type: object - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - group: - type: string - includeSharedProjects: - type: boolean - includeSubgroups: - type: boolean - insecure: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - topic: - type: string - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: array - mergeKeys: - items: - type: string - type: array - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - required: - - generators - - mergeKeys - type: object - plugin: - properties: - configMapRef: - properties: - name: - type: string - required: - - name - type: object - input: - properties: - parameters: - additionalProperties: - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - required: - - configMapRef - type: object - pullRequest: - properties: - azuredevops: - properties: - api: - type: string - labels: - items: - type: string - type: array - organization: - type: string - project: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - - project - - repo - type: object - bitbucket: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - owner: - type: string - repo: - type: string - required: - - owner - - repo - type: object - bitbucketServer: - properties: - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - repo: - type: string - required: - - api - - project - - repo - type: object - filters: - items: - properties: - branchMatch: - type: string - targetBranchMatch: - type: string - type: object - type: array - gitea: - properties: - api: - type: string - insecure: - type: boolean - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - - repo - type: object - github: - properties: - api: - type: string - appSecretName: - type: string - labels: - items: - type: string - type: array - owner: - type: string - repo: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - owner - - repo - type: object - gitlab: - properties: - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - labels: - items: - type: string - type: array - project: - type: string - pullRequestState: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - project - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - type: object - scmProvider: - properties: - awsCodeCommit: - properties: - allBranches: - type: boolean - region: - type: string - role: - type: string - tagFilters: - items: - properties: - key: - type: string - value: - type: string - required: - - key - type: object - type: array - type: object - azureDevOps: - properties: - accessTokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - allBranches: - type: boolean - api: - type: string - organization: - type: string - teamProject: - type: string - required: - - accessTokenRef - - organization - - teamProject - type: object - bitbucket: - properties: - allBranches: - type: boolean - appPasswordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - owner: - type: string - user: - type: string - required: - - appPasswordRef - - owner - - user - type: object - bitbucketServer: - properties: - allBranches: - type: boolean - api: - type: string - basicAuth: - properties: - passwordRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - username: - type: string - required: - - passwordRef - - username - type: object - bearerToken: - properties: - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - tokenRef - type: object - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - insecure: - type: boolean - project: - type: string - required: - - api - - project - type: object - cloneProtocol: - type: string - filters: - items: - properties: - branchMatch: - type: string - labelMatch: - type: string - pathsDoNotExist: - items: - type: string - type: array - pathsExist: - items: - type: string - type: array - repositoryMatch: - type: string - type: object - type: array - gitea: - properties: - allBranches: - type: boolean - api: - type: string - insecure: - type: boolean - owner: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - api - - owner - type: object - github: - properties: - allBranches: - type: boolean - api: - type: string - appSecretName: - type: string - organization: - type: string - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - required: - - organization - type: object - gitlab: - properties: - allBranches: - type: boolean - api: - type: string - caRef: - properties: - configMapName: - type: string - key: - type: string - required: - - configMapName - - key - type: object - group: - type: string - includeSharedProjects: - type: boolean - includeSubgroups: - type: boolean - insecure: - type: boolean - tokenRef: - properties: - key: - type: string - secretName: - type: string - required: - - key - - secretName - type: object - topic: - type: string - required: - - group - type: object - requeueAfterSeconds: - format: int64 - type: integer - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - values: - additionalProperties: - type: string - type: object - type: object - selector: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - type: object - type: object - x-kubernetes-map-type: atomic - type: object - type: array - goTemplate: - type: boolean - goTemplateOptions: - items: - type: string - type: array - ignoreApplicationDifferences: - items: - properties: - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - name: - type: string - type: object - type: array - preservedFields: - properties: - annotations: - items: - type: string - type: array - labels: - items: - type: string - type: array - type: object - strategy: - properties: - rollingSync: - properties: - steps: - items: - properties: - matchExpressions: - items: - properties: - key: - type: string - operator: - type: string - values: - items: - type: string - type: array - type: object - type: array - maxUpdate: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - type: object - type: array - type: object - type: - type: string - type: object - syncPolicy: - properties: - applicationsSync: - enum: - - create-only - - create-update - - create-delete - - sync - type: string - preserveResourcesOnDeletion: - type: boolean - type: object - template: - properties: - metadata: - properties: - annotations: - additionalProperties: - type: string - type: object - finalizers: - items: - type: string - type: array - labels: - additionalProperties: - type: string - type: object - name: - type: string - namespace: - type: string - type: object - spec: - properties: - destination: - properties: - name: - type: string - namespace: - type: string - server: - type: string - type: object - ignoreDifferences: - items: - properties: - group: - type: string - jqPathExpressions: - items: - type: string - type: array - jsonPointers: - items: - type: string - type: array - kind: - type: string - managedFieldsManagers: - items: - type: string - type: array - name: - type: string - namespace: - type: string - required: - - kind - type: object - type: array - info: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - project: - type: string - revisionHistoryLimit: - format: int64 - type: integer - source: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - sourceHydrator: - properties: - drySource: - properties: - path: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - path - - repoURL - - targetRevision - type: object - hydrateTo: - properties: - targetBranch: - type: string - required: - - targetBranch - type: object - syncSource: - properties: - path: - type: string - targetBranch: - type: string - required: - - path - - targetBranch - type: object - required: - - drySource - - syncSource - type: object - sources: - items: - properties: - chart: - type: string - directory: - properties: - exclude: - type: string - include: - type: string - jsonnet: - properties: - extVars: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - libs: - items: - type: string - type: array - tlas: - items: - properties: - code: - type: boolean - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - type: object - recurse: - type: boolean - type: object - helm: - properties: - apiVersions: - items: - type: string - type: array - fileParameters: - items: - properties: - name: - type: string - path: - type: string - type: object - type: array - ignoreMissingValueFiles: - type: boolean - kubeVersion: - type: string - namespace: - type: string - parameters: - items: - properties: - forceString: - type: boolean - name: - type: string - value: - type: string - type: object - type: array - passCredentials: - type: boolean - releaseName: - type: string - skipCrds: - type: boolean - skipSchemaValidation: - type: boolean - skipTests: - type: boolean - valueFiles: - items: - type: string - type: array - values: - type: string - valuesObject: - type: object - x-kubernetes-preserve-unknown-fields: true - version: - type: string - type: object - kustomize: - properties: - apiVersions: - items: - type: string - type: array - commonAnnotations: - additionalProperties: - type: string - type: object - commonAnnotationsEnvsubst: - type: boolean - commonLabels: - additionalProperties: - type: string - type: object - components: - items: - type: string - type: array - forceCommonAnnotations: - type: boolean - forceCommonLabels: - type: boolean - images: - items: - type: string - type: array - kubeVersion: - type: string - labelWithoutSelector: - type: boolean - namePrefix: - type: string - nameSuffix: - type: string - namespace: - type: string - patches: - items: - properties: - options: - additionalProperties: - type: boolean - type: object - patch: - type: string - path: - type: string - target: - properties: - annotationSelector: - type: string - group: - type: string - kind: - type: string - labelSelector: - type: string - name: - type: string - namespace: - type: string - version: - type: string - type: object - type: object - type: array - replicas: - items: - properties: - count: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - name: - type: string - required: - - count - - name - type: object - type: array - version: - type: string - type: object - name: - type: string - path: - type: string - plugin: - properties: - env: - items: - properties: - name: - type: string - value: - type: string - required: - - name - - value - type: object - type: array - name: - type: string - parameters: - items: - properties: - array: - items: - type: string - type: array - map: - additionalProperties: - type: string - type: object - name: - type: string - string: - type: string - type: object - type: array - type: object - ref: - type: string - repoURL: - type: string - targetRevision: - type: string - required: - - repoURL - type: object - type: array - syncPolicy: - properties: - automated: - properties: - allowEmpty: - type: boolean - prune: - type: boolean - selfHeal: - type: boolean - type: object - managedNamespaceMetadata: - properties: - annotations: - additionalProperties: - type: string - type: object - labels: - additionalProperties: - type: string - type: object - type: object - retry: - properties: - backoff: - properties: - duration: - type: string - factor: - format: int64 - type: integer - maxDuration: - type: string - type: object - limit: - format: int64 - type: integer - type: object - syncOptions: - items: - type: string - type: array - type: object - required: - - destination - - project - type: object - required: - - metadata - - spec - type: object - templatePatch: - type: string - required: - - generators - - template - type: object - status: - properties: - applicationStatus: - items: - properties: - application: - type: string - lastTransitionTime: - format: date-time - type: string - message: - type: string - status: - type: string - step: - type: string - targetRevisions: - items: - type: string - type: array - required: - - application - - message - - status - - step - - targetRevisions - type: object - type: array - conditions: - items: - properties: - lastTransitionTime: - format: date-time - type: string - message: - type: string - reason: - type: string - status: - type: string - type: - type: string - required: - - message - - reason - - status - - type - type: object - type: array - resources: - items: - properties: - group: - type: string - health: - properties: - lastTransitionTime: - format: date-time - type: string - message: - type: string - status: - type: string - type: object - hook: - type: boolean - kind: - type: string - name: - type: string - namespace: - type: string - requiresDeletionConfirmation: - type: boolean - requiresPruning: - type: boolean - status: - type: string - syncWave: - format: int64 - type: integer - version: - type: string - type: object - type: array - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - subresources: - status: {} - --- - apiVersion: apiextensions.k8s.io/v1 - kind: CustomResourceDefinition - metadata: - labels: - app.kubernetes.io/name: appprojects.argoproj.io - app.kubernetes.io/part-of: argocd - name: appprojects.argoproj.io - spec: - group: argoproj.io - names: - kind: AppProject - listKind: AppProjectList - plural: appprojects - shortNames: - - appproj - - appprojs - singular: appproject - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: |- - AppProject provides a logical grouping of applications, providing controls for: - * where the apps may deploy to (cluster whitelist) - * what may be deployed (repository whitelist, resource whitelist/blacklist) - * who can access these applications (roles, OIDC group claims bindings) - * and what they can do (RBAC policies) - * automation access to these roles (JWT tokens) - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: AppProjectSpec is the specification of an AppProject - properties: - clusterResourceBlacklist: - description: ClusterResourceBlacklist contains list of blacklisted - cluster level resources - items: - description: |- - GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying - concepts during lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - clusterResourceWhitelist: - description: ClusterResourceWhitelist contains list of whitelisted - cluster level resources - items: - description: |- - GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying - concepts during lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - description: - description: Description contains optional project description - type: string - destinationServiceAccounts: - description: DestinationServiceAccounts holds information about the - service accounts to be impersonated for the application sync operation - for each destination. - items: - description: ApplicationDestinationServiceAccount holds information - about the service account to be impersonated for the application - sync operation. - properties: - defaultServiceAccount: - description: DefaultServiceAccount to be used for impersonation - during the sync operation - type: string - namespace: - description: Namespace specifies the target namespace for the - application's resources. - type: string - server: - description: Server specifies the URL of the target cluster's - Kubernetes control plane API. - type: string - required: - - defaultServiceAccount - - server - type: object - type: array - destinations: - description: Destinations contains list of destinations available - for deployment - items: - description: ApplicationDestination holds information about the - application's destination - properties: - name: - description: Name is an alternate way of specifying the target - cluster by its symbolic name. This must be set if Server is - not set. - type: string - namespace: - description: |- - Namespace specifies the target namespace for the application's resources. - The namespace will only be set for namespace-scoped resources that have not set a value for .metadata.namespace - type: string - server: - description: Server specifies the URL of the target cluster's - Kubernetes control plane API. This must be set if Name is - not set. - type: string - type: object - type: array - namespaceResourceBlacklist: - description: NamespaceResourceBlacklist contains list of blacklisted - namespace level resources - items: - description: |- - GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying - concepts during lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - namespaceResourceWhitelist: - description: NamespaceResourceWhitelist contains list of whitelisted - namespace level resources - items: - description: |- - GroupKind specifies a Group and a Kind, but does not force a version. This is useful for identifying - concepts during lookup stages without having partially valid types - properties: - group: - type: string - kind: - type: string - required: - - group - - kind - type: object - type: array - orphanedResources: - description: OrphanedResources specifies if controller should monitor - orphaned resources of apps in this project - properties: - ignore: - description: Ignore contains a list of resources that are to be - excluded from orphaned resources monitoring - items: - description: OrphanedResourceKey is a reference to a resource - to be ignored from - properties: - group: - type: string - kind: - type: string - name: - type: string - type: object - type: array - warn: - description: Warn indicates if warning condition should be created - for apps which have orphaned resources - type: boolean - type: object - permitOnlyProjectScopedClusters: - description: PermitOnlyProjectScopedClusters determines whether destinations - can only reference clusters which are project-scoped - type: boolean - roles: - description: Roles are user defined RBAC roles associated with this - project - items: - description: ProjectRole represents a role that has access to a - project - properties: - description: - description: Description is a description of the role - type: string - groups: - description: Groups are a list of OIDC group claims bound to - this role - items: - type: string - type: array - jwtTokens: - description: JWTTokens are a list of generated JWT tokens bound - to this role - items: - description: JWTToken holds the issuedAt and expiresAt values - of a token - properties: - exp: - format: int64 - type: integer - iat: - format: int64 - type: integer - id: - type: string - required: - - iat - type: object - type: array - name: - description: Name is a name for this role - type: string - policies: - description: Policies Stores a list of casbin formatted strings - that define access policies for the role in the project - items: - type: string - type: array - required: - - name - type: object - type: array - signatureKeys: - description: SignatureKeys contains a list of PGP key IDs that commits - in Git must be signed with in order to be allowed for sync - items: - description: SignatureKey is the specification of a key required - to verify commit signatures with - properties: - keyID: - description: The ID of the key in hexadecimal notation - type: string - required: - - keyID - type: object - type: array - sourceNamespaces: - description: SourceNamespaces defines the namespaces application resources - are allowed to be created in - items: - type: string - type: array - sourceRepos: - description: SourceRepos contains list of repository URLs which can - be used for deployment - items: - type: string - type: array - syncWindows: - description: SyncWindows controls when syncs can be run for apps in - this project - items: - description: SyncWindow contains the kind, time, duration and attributes - that are used to assign the syncWindows to apps - properties: - applications: - description: Applications contains a list of applications that - the window will apply to - items: - type: string - type: array - clusters: - description: Clusters contains a list of clusters that the window - will apply to - items: - type: string - type: array - duration: - description: Duration is the amount of time the sync window - will be open - type: string - kind: - description: Kind defines if the window allows or blocks syncs - type: string - manualSync: - description: ManualSync enables manual syncs when they would - otherwise be blocked - type: boolean - namespaces: - description: Namespaces contains a list of namespaces that the - window will apply to - items: - type: string - type: array - schedule: - description: Schedule is the time the window will begin, specified - in cron format - type: string - timeZone: - description: TimeZone of the sync that will be applied to the - schedule - type: string - type: object - type: array - type: object - status: - description: AppProjectStatus contains status information for AppProject - CRs - properties: - jwtTokensByRole: - additionalProperties: - description: JWTTokens represents a list of JWT tokens - properties: - items: - items: - description: JWTToken holds the issuedAt and expiresAt values - of a token - properties: - exp: - format: int64 - type: integer - iat: - format: int64 - type: integer - id: - type: string - required: - - iat - type: object - type: array - type: object - description: JWTTokensByRole contains a list of JWT tokens issued - for a given role - type: object - type: object - required: - - metadata - - spec - type: object - served: true - storage: true - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - namespace: argocd - --- apiVersion: v1 kind: ServiceAccount metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - namespace: argocd - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server - namespace: argocd - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller - namespace: argocd - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis - namespace: argocd - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server - namespace: argocd - --- - apiVersion: v1 - kind: ServiceAccount - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - namespace: argocd - rules: - - apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch - - apiGroups: - - argoproj.io - resources: - - applications - - appprojects - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - - apiGroups: - - "" - resources: - - events - verbs: - - create - - list - - apiGroups: - - apps - resources: - - deployments - verbs: - - get - - list - - watch - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - namespace: argocd - rules: - - apiGroups: - - argoproj.io - resources: - - applications - - applicationsets - - applicationsets/finalizers - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - argoproj.io - resources: - - appprojects - verbs: - - get - - list - - watch - - apiGroups: - - argoproj.io - resources: - - applicationsets/status - verbs: - - get - - patch - - update - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - watch - - apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch - - apiGroups: - - apps - - extensions - resources: - - deployments - verbs: - - get - - list - - watch - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server - namespace: argocd - rules: - - apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - get - - list - - watch - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller - namespace: argocd - rules: - - apiGroups: - - argoproj.io - resources: - - applications - - appprojects - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - "" - resources: - - configmaps - - secrets - verbs: - - list - - watch - - apiGroups: - - "" - resourceNames: - - argocd-notifications-cm - resources: - - configmaps - verbs: - - get - - apiGroups: - - "" - resourceNames: - - argocd-notifications-secret - resources: - - secrets - verbs: - - get - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis - namespace: argocd - rules: - - apiGroups: - - "" - resourceNames: - - argocd-redis - resources: - - secrets - verbs: - - get - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: Role - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server - namespace: argocd - rules: - - apiGroups: - - "" - resources: - - secrets - - configmaps - verbs: - - create - - get - - list - - watch - - update - - patch - - delete - - apiGroups: - - argoproj.io - resources: - - applications - - appprojects - - applicationsets - verbs: - - create - - get - - list - - watch - - update - - delete - - patch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - list - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - rules: - - apiGroups: - - '*' - resources: - - '*' - verbs: - - '*' - - nonResourceURLs: - - '*' - verbs: - - '*' - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRole - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - rules: - - apiGroups: - - argoproj.io - resources: - - applications - - applicationsets - - applicationsets/finalizers - verbs: - - create - - delete - - get - - list - - patch - - update - - watch - - apiGroups: - - argoproj.io - resources: - - applicationsets/status - verbs: - - get - - patch - - update - - apiGroups: - - argoproj.io - resources: - - appprojects - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - get - - list - - patch - - watch - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - update - - delete - - get - - list - - patch - - watch - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - apps - - extensions - resources: - - deployments - verbs: - - get - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - delete - - get - - list - - patch - - update - - watch + name: argocd-manager + namespace: kube-system --- + # Scope: everything the declared oci-lab applications manage (CRDs, + # cluster-scoped resources for cilium/cert-manager) minus + # privilege-escalation verbs (escalate/bind/impersonate). The API is + # reachable only over the private VPN path, which bounds residual risk. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server + name: argocd-manager rules: - - apiGroups: - - '*' - resources: - - '*' - verbs: - - delete - - get - - patch - - apiGroups: - - "" - resources: - - events - verbs: - - list - - apiGroups: - - "" - resources: - - pods - - pods/log - verbs: - - get - - apiGroups: - - argoproj.io - resources: - - applications - - applicationsets - verbs: - - get - - list - - watch - - apiGroups: - - batch - resources: - - jobs - verbs: - - create - - apiGroups: - - argoproj.io - resources: - - workflows - verbs: - - create - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-application-controller - subjects: - - kind: ServiceAccount - name: argocd-application-controller - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-applicationset-controller - subjects: - - kind: ServiceAccount - name: argocd-applicationset-controller - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-dex-server - subjects: - - kind: ServiceAccount - name: argocd-dex-server - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-notifications-controller - subjects: - - kind: ServiceAccount - name: argocd-notifications-controller - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-redis - subjects: - - kind: ServiceAccount - name: argocd-redis - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: RoleBinding - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server - namespace: argocd - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-server - subjects: - - kind: ServiceAccount - name: argocd-server - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: argocd-application-controller - subjects: - - kind: ServiceAccount - name: argocd-application-controller - namespace: argocd - --- - apiVersion: rbac.authorization.k8s.io/v1 - kind: ClusterRoleBinding - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: argocd-applicationset-controller - subjects: - - kind: ServiceAccount - name: argocd-applicationset-controller - namespace: argocd + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "deletecollection"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server + name: argocd-manager roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: argocd-server + name: argocd-manager subjects: - - kind: ServiceAccount - name: argocd-server - namespace: argocd - --- - apiVersion: v1 - data: - application.resourceTrackingMethod: label - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-cm - app.kubernetes.io/part-of: argocd - name: argocd-cm - namespace: argocd - --- - apiVersion: v1 - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-cmd-params-cm - app.kubernetes.io/part-of: argocd - name: argocd-cmd-params-cm - namespace: argocd - --- - apiVersion: v1 - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-gpg-keys-cm - app.kubernetes.io/part-of: argocd - name: argocd-gpg-keys-cm - namespace: argocd - --- - apiVersion: v1 - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-cm - namespace: argocd - --- - apiVersion: v1 - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-rbac-cm - app.kubernetes.io/part-of: argocd - name: argocd-rbac-cm - namespace: argocd - --- - apiVersion: v1 - data: - ssh_known_hosts: | - # This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT - [ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - [ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - [ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= - bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE= - bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO - bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M= - github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= - github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl - github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= - gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY= - gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf - gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9 - ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H - vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-ssh-known-hosts-cm - app.kubernetes.io/part-of: argocd - name: argocd-ssh-known-hosts-cm - namespace: argocd - --- - apiVersion: v1 - kind: ConfigMap - metadata: - labels: - app.kubernetes.io/name: argocd-tls-certs-cm - app.kubernetes.io/part-of: argocd - name: argocd-tls-certs-cm - namespace: argocd - --- - apiVersion: v1 - kind: Secret - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-secret - namespace: argocd - type: Opaque - --- - apiVersion: v1 - kind: Secret - metadata: - labels: - app.kubernetes.io/name: argocd-secret - app.kubernetes.io/part-of: argocd - name: argocd-secret - namespace: argocd - type: Opaque - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - namespace: argocd - spec: - ports: - - name: webhook - port: 7000 - protocol: TCP - targetPort: webhook - - name: metrics - port: 8080 - protocol: TCP - targetPort: metrics - selector: - app.kubernetes.io/name: argocd-applicationset-controller - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server - namespace: argocd - spec: - ports: - - appProtocol: TCP - name: http - port: 5556 - protocol: TCP - targetPort: 5556 - - name: grpc - port: 5557 - protocol: TCP - targetPort: 5557 - - name: metrics - port: 5558 - protocol: TCP - targetPort: 5558 - selector: - app.kubernetes.io/name: argocd-dex-server - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: metrics - app.kubernetes.io/name: argocd-metrics - app.kubernetes.io/part-of: argocd - name: argocd-metrics - namespace: argocd - spec: - ports: - - name: metrics - port: 8082 - protocol: TCP - targetPort: 8082 - selector: - app.kubernetes.io/name: argocd-application-controller - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller-metrics - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller-metrics - namespace: argocd - spec: - ports: - - name: metrics - port: 9001 - protocol: TCP - targetPort: 9001 - selector: - app.kubernetes.io/name: argocd-notifications-controller - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis - namespace: argocd - spec: - ports: - - name: tcp-redis - port: 6379 - targetPort: 6379 - selector: - app.kubernetes.io/name: argocd-redis - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server - namespace: argocd - spec: - ports: - - name: server - port: 8081 - protocol: TCP - targetPort: 8081 - - name: metrics - port: 8084 - protocol: TCP - targetPort: 8084 - selector: - app.kubernetes.io/name: argocd-repo-server - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server - namespace: argocd - spec: - ports: - - name: http - port: 80 - protocol: TCP - targetPort: 8080 - - name: https - port: 443 - protocol: TCP - targetPort: 8080 - selector: - app.kubernetes.io/name: argocd-server - --- - apiVersion: v1 - kind: Service - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server-metrics - app.kubernetes.io/part-of: argocd - name: argocd-server-metrics - namespace: argocd - spec: - ports: - - name: metrics - port: 8083 - protocol: TCP - targetPort: 8083 - selector: - app.kubernetes.io/name: argocd-server - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: applicationset-controller - app.kubernetes.io/name: argocd-applicationset-controller - app.kubernetes.io/part-of: argocd - name: argocd-applicationset-controller - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-applicationset-controller - template: - metadata: - labels: - app.kubernetes.io/name: argocd-applicationset-controller - spec: - containers: - - args: - - /usr/local/bin/argocd-applicationset-controller - env: - - name: ARGOCD_APPLICATIONSET_CONTROLLER_GLOBAL_PRESERVED_ANNOTATIONS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.global.preserved.annotations - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_GLOBAL_PRESERVED_LABELS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.global.preserved.labels - name: argocd-cmd-params-cm - optional: true - - name: NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_LEADER_ELECTION - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.leader.election - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_POLICY - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.policy - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_POLICY_OVERRIDE - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.policy.override - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_DEBUG - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.debug - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_DRY_RUN - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.dryrun - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_MODULES_ENABLED - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.git.submodule - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_PROGRESSIVE_SYNCS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.progressive.syncs - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_TOKENREF_STRICT_MODE - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.tokenref.strict.mode - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.new.git.file.globbing - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.repo.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.repo.server.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_CONCURRENT_RECONCILIATIONS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.concurrent.reconciliations.max - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_NAMESPACES - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.scm.root.ca.path - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ALLOWED_SCM_PROVIDERS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.allowed.scm.providers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_SCM_PROVIDERS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.scm.providers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_WEBHOOK_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.webhook.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_REQUEUE_AFTER - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.requeue.after - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - name: argocd-applicationset-controller - ports: - - containerPort: 7000 - name: webhook - - containerPort: 8080 - name: metrics - resources: - limits: - cpu: 200m - memory: 256Mi - requests: - cpu: 20m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/gpg/source - name: gpg-keys - - mountPath: /app/config/gpg/keys - name: gpg-keyring - - mountPath: /tmp - name: tmp - - mountPath: /app/config/reposerver/tls - name: argocd-repo-server-tls - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: argocd-applicationset-controller - volumes: - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - configMap: - name: argocd-gpg-keys-cm - name: gpg-keys - - emptyDir: {} - name: gpg-keyring - - emptyDir: {} - name: tmp - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: dex-server - app.kubernetes.io/name: argocd-dex-server - app.kubernetes.io/part-of: argocd - name: argocd-dex-server - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-dex-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-dex-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - command: - - /shared/argocd-dex - - rundex - env: - - name: ARGOCD_DEX_SERVER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: dexserver.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEX_SERVER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: dexserver.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEX_SERVER_DISABLE_TLS - valueFrom: - configMapKeyRef: - key: dexserver.disable.tls - name: argocd-cmd-params-cm - optional: true - image: ghcr.io/dexidp/dex:v2.41.1 - imagePullPolicy: Always - name: dex - ports: - - containerPort: 5556 - - containerPort: 5557 - - containerPort: 5558 - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 20m - memory: 32Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /shared - name: static-files - - mountPath: /tmp - name: dexconfig - - mountPath: /tls - name: argocd-dex-server-tls - initContainers: - - command: - - /bin/cp - - -n - - /usr/local/bin/argocd - - /shared/argocd-dex - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - name: copyutil - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /shared - name: static-files - - mountPath: /tmp - name: dexconfig - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: argocd-dex-server - volumes: - - emptyDir: {} - name: static-files - - emptyDir: {} - name: dexconfig - - name: argocd-dex-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-dex-server-tls - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - strategy: - type: Recreate - template: - metadata: - labels: - app.kubernetes.io/name: argocd-notifications-controller - spec: - containers: - - args: - - /usr/local/bin/argocd-notifications - env: - - name: ARGOCD_NOTIFICATIONS_CONTROLLER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: notificationscontroller.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_NOTIFICATIONS_CONTROLLER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: notificationscontroller.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_NAMESPACES - valueFrom: - configMapKeyRef: - key: application.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_NOTIFICATION_CONTROLLER_SELF_SERVICE_NOTIFICATION_ENABLED - valueFrom: - configMapKeyRef: - key: notificationscontroller.selfservice.enabled - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_NOTIFICATION_CONTROLLER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: notificationscontroller.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - livenessProbe: - tcpSocket: - port: 9001 - name: argocd-notifications-controller - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 20m - memory: 32Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - volumeMounts: - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/reposerver/tls - name: argocd-repo-server-tls - workingDir: /app - nodeSelector: - kubernetes.io/os: linux - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - serviceAccountName: argocd-notifications-controller - volumes: - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: redis - app.kubernetes.io/name: argocd-redis - app.kubernetes.io/part-of: argocd - name: argocd-redis - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-redis - template: - metadata: - labels: - app.kubernetes.io/name: argocd-redis - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-redis - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - --save - - "" - - --appendonly - - "no" - - --requirepass $(REDIS_PASSWORD) - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - key: auth - name: argocd-redis - image: redis:7.0.15-alpine - imagePullPolicy: Always - name: redis - ports: - - containerPort: 6379 - resources: - limits: - cpu: 200m - memory: 128Mi - requests: - cpu: 50m - memory: 32Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - initContainers: - - command: - - argocd - - admin - - redis-initial-password - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: IfNotPresent - name: secret-init - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - nodeSelector: - kubernetes.io/os: linux - securityContext: - runAsNonRoot: true - runAsUser: 999 - seccompProfile: - type: RuntimeDefault - serviceAccountName: argocd-redis - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: repo-server - app.kubernetes.io/name: argocd-repo-server - app.kubernetes.io/part-of: argocd - name: argocd-repo-server - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-repo-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - automountServiceAccountToken: false - containers: - - args: - - /usr/local/bin/argocd-repo-server - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - key: auth - name: argocd-redis - - name: ARGOCD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_REPO_SERVER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: reposerver.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: reposerver.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: reposerver.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_LISTEN_ADDRESS - valueFrom: - configMapKeyRef: - key: reposerver.listen.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_LISTEN_METRICS_ADDRESS - valueFrom: - configMapKeyRef: - key: reposerver.metrics.listen.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_DISABLE_TLS - valueFrom: - configMapKeyRef: - key: reposerver.disable.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MIN_VERSION - valueFrom: - configMapKeyRef: - key: reposerver.tls.minversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MAX_VERSION - valueFrom: - configMapKeyRef: - key: reposerver.tls.maxversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_CIPHERS - valueFrom: - configMapKeyRef: - key: reposerver.tls.ciphers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: reposerver.repo.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: reposerver.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_OTLP_INSECURE - valueFrom: - configMapKeyRef: - key: otlp.insecure - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_OTLP_HEADERS - valueFrom: - configMapKeyRef: - key: otlp.headers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_MAX_COMBINED_DIRECTORY_MANIFESTS_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.max.combined.directory.manifests.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_PLUGIN_TAR_EXCLUSIONS - valueFrom: - configMapKeyRef: - key: reposerver.plugin.tar.exclusions - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_PLUGIN_USE_MANIFEST_GENERATE_PATHS - valueFrom: - configMapKeyRef: - key: reposerver.plugin.use.manifest.generate.paths - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_ALLOW_OUT_OF_BOUNDS_SYMLINKS - valueFrom: - configMapKeyRef: - key: reposerver.allow.oob.symlinks - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_TAR_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.streamed.manifest.max.tar.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_STREAMED_MANIFEST_MAX_EXTRACTED_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.streamed.manifest.max.extracted.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_HELM_MANIFEST_MAX_EXTRACTED_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.helm.manifest.max.extracted.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_DISABLE_HELM_MANIFEST_MAX_EXTRACTED_SIZE - valueFrom: - configMapKeyRef: - key: reposerver.disable.helm.manifest.max.extracted.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REVISION_CACHE_LOCK_TIMEOUT - valueFrom: - configMapKeyRef: - key: reposerver.revision.cache.lock.timeout - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_MODULES_ENABLED - valueFrom: - configMapKeyRef: - key: reposerver.enable.git.submodule - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_LS_REMOTE_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: reposerver.git.lsremote.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GIT_REQUEST_TIMEOUT - valueFrom: - configMapKeyRef: - key: reposerver.git.request.timeout - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_GRPC_MAX_SIZE_MB - valueFrom: - configMapKeyRef: - key: reposerver.grpc.max.size - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_REPO_SERVER_INCLUDE_HIDDEN_DIRECTORIES - valueFrom: - configMapKeyRef: - key: reposerver.include.hidden.directories - name: argocd-cmd-params-cm - optional: true - - name: HELM_CACHE_HOME - value: /helm-working-dir - - name: HELM_CONFIG_HOME - value: /helm-working-dir - - name: HELM_DATA_HOME - value: /helm-working-dir - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - livenessProbe: - failureThreshold: 3 - httpGet: - path: /healthz?full=true - port: 8084 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - name: argocd-repo-server - ports: - - containerPort: 8081 - - containerPort: 8084 - readinessProbe: - httpGet: - path: /healthz - port: 8084 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: 500m - memory: 512Mi - requests: - cpu: 100m - memory: 128Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/gpg/source - name: gpg-keys - - mountPath: /app/config/gpg/keys - name: gpg-keyring - - mountPath: /app/config/reposerver/tls - name: argocd-repo-server-tls - - mountPath: /tmp - name: tmp - - mountPath: /helm-working-dir - name: helm-working-dir - - mountPath: /home/argocd/cmp-server/plugins - name: plugins - initContainers: - - command: - - /bin/cp - - -n - - /usr/local/bin/argocd - - /var/run/argocd/argocd-cmp-server - image: quay.io/argoproj/argocd:v2.14.4 - name: copyutil - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /var/run/argocd - name: var-files - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: argocd-repo-server - volumes: - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - configMap: - name: argocd-gpg-keys-cm - name: gpg-keys - - emptyDir: {} - name: gpg-keyring - - emptyDir: {} - name: tmp - - emptyDir: {} - name: helm-working-dir - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - - emptyDir: {} - name: var-files - - emptyDir: {} - name: plugins - --- - apiVersion: apps/v1 - kind: Deployment - metadata: - labels: - app.kubernetes.io/component: server - app.kubernetes.io/name: argocd-server - app.kubernetes.io/part-of: argocd - name: argocd-server - namespace: argocd - spec: - selector: - matchLabels: - app.kubernetes.io/name: argocd-server - template: - metadata: - labels: - app.kubernetes.io/name: argocd-server - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - /usr/local/bin/argocd-server - - --insecure - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - key: auth - name: argocd-redis - - name: ARGOCD_SERVER_INSECURE - valueFrom: - configMapKeyRef: - key: server.insecure - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_BASEHREF - valueFrom: - configMapKeyRef: - key: server.basehref - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ROOTPATH - valueFrom: - configMapKeyRef: - key: server.rootpath - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: server.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOG_LEVEL - valueFrom: - configMapKeyRef: - key: server.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER - valueFrom: - configMapKeyRef: - key: server.dex.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DISABLE_AUTH - valueFrom: - configMapKeyRef: - key: server.disable.auth - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ENABLE_GZIP - valueFrom: - configMapKeyRef: - key: server.enable.gzip - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: server.repo.server.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_X_FRAME_OPTIONS - valueFrom: - configMapKeyRef: - key: server.x.frame.options - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_CONTENT_SECURITY_POLICY - valueFrom: - configMapKeyRef: - key: server.content.security.policy - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: server.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_REPO_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: server.repo.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: server.dex.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_DEX_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: server.dex.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MIN_VERSION - valueFrom: - configMapKeyRef: - key: server.tls.minversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_MAX_VERSION - valueFrom: - configMapKeyRef: - key: server.tls.maxversion - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_TLS_CIPHERS - valueFrom: - configMapKeyRef: - key: server.tls.ciphers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_CONNECTION_STATUS_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.connection.status.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OIDC_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.oidc.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LOGIN_ATTEMPTS_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.login.attempts.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_STATIC_ASSETS - valueFrom: - configMapKeyRef: - key: server.staticassets - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APP_STATE_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.app.state.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: server.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_MAX_COOKIE_NUMBER - valueFrom: - configMapKeyRef: - key: server.http.cookie.maxnumber - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_LISTEN_ADDRESS - valueFrom: - configMapKeyRef: - key: server.listen.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_METRICS_LISTEN_ADDRESS - valueFrom: - configMapKeyRef: - key: server.metrics.listen.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OTLP_INSECURE - valueFrom: - configMapKeyRef: - key: otlp.insecure - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_OTLP_HEADERS - valueFrom: - configMapKeyRef: - key: otlp.headers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_NAMESPACES - valueFrom: - configMapKeyRef: - key: application.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_ENABLE_PROXY_EXTENSION - valueFrom: - configMapKeyRef: - key: server.enable.proxy.extension - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_K8SCLIENT_RETRY_MAX - valueFrom: - configMapKeyRef: - key: server.k8sclient.retry.max - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_K8SCLIENT_RETRY_BASE_BACKOFF - valueFrom: - configMapKeyRef: - key: server.k8sclient.retry.base.backoff - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_API_CONTENT_TYPES - valueFrom: - configMapKeyRef: - key: server.api.content.types - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_SERVER_WEBHOOK_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: server.webhook.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_NEW_GIT_FILE_GLOBBING - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.new.git.file.globbing - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_SCM_ROOT_CA_PATH - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.scm.root.ca.path - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ALLOWED_SCM_PROVIDERS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.allowed.scm.providers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_SCM_PROVIDERS - valueFrom: - configMapKeyRef: - key: applicationsetcontroller.enable.scm.providers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_HYDRATOR_ENABLED - valueFrom: - configMapKeyRef: - key: hydrator.enabled - name: argocd-cmd-params-cm - optional: true - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthz?full=true - port: 8080 - initialDelaySeconds: 3 - periodSeconds: 30 - timeoutSeconds: 5 - name: argocd-server - ports: - - containerPort: 8080 - - containerPort: 8083 - readinessProbe: - httpGet: - path: /healthz - port: 8080 - initialDelaySeconds: 3 - periodSeconds: 30 - resources: - limits: - cpu: 300m - memory: 256Mi - requests: - cpu: 50m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/ssh - name: ssh-known-hosts - - mountPath: /app/config/tls - name: tls-certs - - mountPath: /app/config/server/tls - name: argocd-repo-server-tls - - mountPath: /app/config/dex/tls - name: argocd-dex-server-tls - - mountPath: /home/argocd - name: plugins-home - - mountPath: /tmp - name: tmp - - mountPath: /home/argocd/params - name: argocd-cmd-params-cm - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: argocd-server - volumes: - - emptyDir: {} - name: plugins-home - - emptyDir: {} - name: tmp - - configMap: - name: argocd-ssh-known-hosts-cm - name: ssh-known-hosts - - configMap: - name: argocd-tls-certs-cm - name: tls-certs - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - - name: argocd-dex-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-dex-server-tls - - configMap: - items: - - key: server.profile.enabled - path: profiler.enabled - name: argocd-cmd-params-cm - optional: true - name: argocd-cmd-params-cm - --- - apiVersion: apps/v1 - kind: StatefulSet - metadata: - labels: - app.kubernetes.io/component: application-controller - app.kubernetes.io/name: argocd-application-controller - app.kubernetes.io/part-of: argocd - name: argocd-application-controller - namespace: argocd - spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - serviceName: argocd-application-controller - template: - metadata: - labels: - app.kubernetes.io/name: argocd-application-controller - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - topologyKey: kubernetes.io/hostname - weight: 100 - - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/part-of: argocd - topologyKey: kubernetes.io/hostname - weight: 5 - containers: - - args: - - /usr/local/bin/argocd-application-controller - env: - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - key: auth - name: argocd-redis - - name: ARGOCD_CONTROLLER_REPLICAS - value: "1" - - name: ARGOCD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_HARD_RECONCILIATION_TIMEOUT - valueFrom: - configMapKeyRef: - key: timeout.hard.reconciliation - name: argocd-cm - optional: true - - name: ARGOCD_RECONCILIATION_JITTER - valueFrom: - configMapKeyRef: - key: timeout.reconciliation.jitter - name: argocd-cm - optional: true - - name: ARGOCD_REPO_ERROR_GRACE_PERIOD_SECONDS - valueFrom: - configMapKeyRef: - key: controller.repo.error.grace.period.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER - valueFrom: - configMapKeyRef: - key: repo.server - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: controller.repo.server.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_STATUS_PROCESSORS - valueFrom: - configMapKeyRef: - key: controller.status.processors - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OPERATION_PROCESSORS - valueFrom: - configMapKeyRef: - key: controller.operation.processors - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_LOGFORMAT - valueFrom: - configMapKeyRef: - key: controller.log.format - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_LOGLEVEL - valueFrom: - configMapKeyRef: - key: controller.log.level - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_METRICS_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.metrics.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: controller.self.heal.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_TIMEOUT_SECONDS - valueFrom: - configMapKeyRef: - key: controller.self.heal.backoff.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_FACTOR - valueFrom: - configMapKeyRef: - key: controller.self.heal.backoff.factor - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SELF_HEAL_BACKOFF_CAP_SECONDS - valueFrom: - configMapKeyRef: - key: controller.self.heal.backoff.cap.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SYNC_TIMEOUT - valueFrom: - configMapKeyRef: - key: controller.sync.timeout.seconds - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_PLAINTEXT - valueFrom: - configMapKeyRef: - key: controller.repo.server.plaintext - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_REPO_SERVER_STRICT_TLS - valueFrom: - configMapKeyRef: - key: controller.repo.server.strict.tls - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_PERSIST_RESOURCE_HEALTH - valueFrom: - configMapKeyRef: - key: controller.resource.health.persist - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APP_STATE_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.app.state.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: REDIS_SERVER - valueFrom: - configMapKeyRef: - key: redis.server - name: argocd-cmd-params-cm - optional: true - - name: REDIS_COMPRESSION - valueFrom: - configMapKeyRef: - key: redis.compression - name: argocd-cmd-params-cm - optional: true - - name: REDISDB - valueFrom: - configMapKeyRef: - key: redis.db - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_DEFAULT_CACHE_EXPIRATION - valueFrom: - configMapKeyRef: - key: controller.default.cache.expiration - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_ADDRESS - valueFrom: - configMapKeyRef: - key: otlp.address - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_INSECURE - valueFrom: - configMapKeyRef: - key: otlp.insecure - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_OTLP_HEADERS - valueFrom: - configMapKeyRef: - key: otlp.headers - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_NAMESPACES - valueFrom: - configMapKeyRef: - key: application.namespaces - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_CONTROLLER_SHARDING_ALGORITHM - valueFrom: - configMapKeyRef: - key: controller.sharding.algorithm - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_KUBECTL_PARALLELISM_LIMIT - valueFrom: - configMapKeyRef: - key: controller.kubectl.parallelism.limit - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_K8SCLIENT_RETRY_MAX - valueFrom: - configMapKeyRef: - key: controller.k8sclient.retry.max - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_K8SCLIENT_RETRY_BASE_BACKOFF - valueFrom: - configMapKeyRef: - key: controller.k8sclient.retry.base.backoff - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_APPLICATION_CONTROLLER_SERVER_SIDE_DIFF - valueFrom: - configMapKeyRef: - key: controller.diff.server.side - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_IGNORE_NORMALIZER_JQ_TIMEOUT - valueFrom: - configMapKeyRef: - key: controller.ignore.normalizer.jq.timeout - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_HYDRATOR_ENABLED - valueFrom: - configMapKeyRef: - key: hydrator.enabled - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_CLUSTER_CACHE_BATCH_EVENTS_PROCESSING - valueFrom: - configMapKeyRef: - key: controller.cluster.cache.batch.events.processing - name: argocd-cmd-params-cm - optional: true - - name: ARGOCD_CLUSTER_CACHE_EVENTS_PROCESSING_INTERVAL - valueFrom: - configMapKeyRef: - key: controller.cluster.cache.events.processing.interval - name: argocd-cmd-params-cm - optional: true - - name: KUBECACHEDIR - value: /tmp/kubecache - image: quay.io/argoproj/argocd:v2.14.4 - imagePullPolicy: Always - name: argocd-application-controller - ports: - - containerPort: 8082 - readinessProbe: - httpGet: - path: /healthz - port: 8082 - initialDelaySeconds: 5 - periodSeconds: 10 - resources: - limits: - cpu: "1" - memory: 768Mi - requests: - cpu: 250m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - volumeMounts: - - mountPath: /app/config/controller/tls - name: argocd-repo-server-tls - - mountPath: /home/argocd - name: argocd-home - - mountPath: /home/argocd/params - name: argocd-cmd-params-cm - - mountPath: /tmp - name: argocd-application-controller-tmp - workingDir: /home/argocd - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: argocd-application-controller - volumes: - - emptyDir: {} - name: argocd-home - - emptyDir: {} - name: argocd-application-controller-tmp - - name: argocd-repo-server-tls - secret: - items: - - key: tls.crt - path: tls.crt - - key: tls.key - path: tls.key - - key: ca.crt - path: ca.crt - optional: true - secretName: argocd-repo-server-tls - - configMap: - items: - - key: controller.profile.enabled - path: profiler.enabled - name: argocd-cmd-params-cm - optional: true - name: argocd-cmd-params-cm - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-application-controller-network-policy - namespace: argocd - spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 8082 - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-applicationset-controller-network-policy - namespace: argocd - spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 7000 - protocol: TCP - - port: 8080 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-applicationset-controller - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-dex-server-network-policy - namespace: argocd - spec: - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - ports: - - port: 5556 - protocol: TCP - - port: 5557 - protocol: TCP - - from: - - namespaceSelector: {} - ports: - - port: 5558 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-dex-server - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - labels: - app.kubernetes.io/component: notifications-controller - app.kubernetes.io/name: argocd-notifications-controller - app.kubernetes.io/part-of: argocd - name: argocd-notifications-controller-network-policy - namespace: argocd - spec: - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 9001 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-redis-network-policy - namespace: argocd - spec: - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - ports: - - port: 6379 - protocol: TCP - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-redis - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-repo-server-network-policy - namespace: argocd - spec: - ingress: - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-application-controller - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-notifications-controller - - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-applicationset-controller - ports: - - port: 8081 - protocol: TCP - - from: - - namespaceSelector: {} - ports: - - port: 8084 - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - policyTypes: - - Ingress - --- - apiVersion: networking.k8s.io/v1 - kind: NetworkPolicy - metadata: - name: argocd-server-network-policy - namespace: argocd - spec: - ingress: - - {} - podSelector: - matchLabels: - app.kubernetes.io/name: argocd-server - policyTypes: - - Ingress - - name: argocd-apps - contents: | - # Layering ApplicationSet — the "chart-app" engine. - # - # SEEDED PER CLUSTER by the Talos inline manifests. The two `list` elements below - # (clusterName / clusterType) are the ONLY per-cluster difference — each cluster's - # inline manifest embeds this file with its own identity. This copy is the - # canonical reference; the identities here are placeholders. - # - # Selection (which apps run): three git generators — - # apps/*/app.yaml shared (every cluster) - # types//apps/*/app.yaml per cluster-TYPE - # clusters//apps/*/app.yaml per CLUSTER - # Values (override anything the chart exposes): deep-merge valueFiles — - # values/base/.yaml -> values/types//.yaml -> values/clusters//.yaml - # Custom ApplicationSets (e.g. arc-runners) are NOT chart-apps and run on the raw - # directory-sync lane (clusters//apps/*/application.yaml), not here. - apiVersion: argoproj.io/v1alpha1 - kind: ApplicationSet - metadata: - name: apps - namespace: argocd - spec: - goTemplate: true - goTemplateOptions: ["missingkey=error"] - generators: - - matrix: # shared apps - generators: - - list: - elements: - - clusterName: oci-lab - clusterType: cloud - - git: - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - revision: HEAD - files: - - path: apps/*/app.yaml - - matrix: # per cluster-TYPE apps - generators: - - list: - elements: - - clusterName: oci-lab - clusterType: cloud - - git: - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - revision: HEAD - files: - - path: types/{{.clusterType}}/apps/*/app.yaml - - matrix: # per CLUSTER apps - generators: - - list: - elements: - - clusterName: oci-lab - clusterType: cloud - - git: - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - revision: HEAD - files: - - path: clusters/{{.clusterName}}/apps/*/app.yaml - template: - metadata: - name: "{{.path.basename}}" # app name = its directory name - spec: - project: default - sources: - - repoURL: "{{.repoURL}}" - chart: "{{.chart}}" - targetRevision: "{{.version}}" - helm: - ignoreMissingValueFiles: true # type/cluster value files are optional - valueFiles: - - $v/values/base/{{.path.basename}}.yaml - - $v/values/types/{{.clusterType}}/{{.path.basename}}.yaml - - $v/values/clusters/{{.clusterName}}/{{.path.basename}}.yaml - - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - targetRevision: HEAD - ref: v - destination: - server: https://kubernetes.default.svc - namespace: "{{.namespace}}" - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - # Allow a CRD-owning chart to establish its custom resource type when - # API discovery lags a cold-cluster bootstrap. - - SkipDryRunOnMissingResource=true - - name: argocd-bootstrap - contents: | - # Raw-manifest lane: syncs bootstrap/ (shared non-chart manifests, e.g. - # the Tailscale operator). - apiVersion: argoproj.io/v1alpha1 - kind: Application - metadata: - name: bootstrap - namespace: argocd - spec: - project: default - source: - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - targetRevision: HEAD - path: bootstrap - destination: - server: https://kubernetes.default.svc - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true - - name: argocd-oci-raw - contents: | - # Raw lane for oci-lab (mirrors argocd-unraid-raw): plain-manifest - # apps that aren't a chart-app, e.g. cert-manager Issuer/Certificate. - apiVersion: argoproj.io/v1alpha1 - kind: Application - metadata: - name: oci-raw - namespace: argocd - spec: - project: default - source: - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps - targetRevision: HEAD - path: clusters/oci-lab/apps - directory: - recurse: true - include: "*/application.yaml" - destination: - server: https://kubernetes.default.svc - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true + - kind: ServiceAccount + name: argocd-manager + namespace: kube-system diff --git a/omni/scripts/generate-manifests.sh b/omni/scripts/generate-manifests.sh index b3a5f98..7f62ef0 100755 --- a/omni/scripts/generate-manifests.sh +++ b/omni/scripts/generate-manifests.sh @@ -1,17 +1,22 @@ #!/usr/bin/env bash # Fill the generated blocks of a cluster's Talos inline-manifests: -# argocd raw Argo CD install manifest (upstream install.yaml) -# argocd-apps the repo-root appset.yaml with THIS cluster's identity substituted -# cilium rendered Cilium (only clusters that bootstrap their own CNI, e.g. OCI) +# unraid-lab argocd raw Argo CD install manifest (upstream install.yaml) +# argocd-apps appset.yaml — the layering ApplicationSet, embedded +# verbatim (it covers BOTH clusters; oci-lab apps are +# reconciled remotely through the registered cluster) +# oci-lab cilium rendered Cilium — oci-lab bootstraps Cilium ONLY, +# no local Argo CD (unraid-lab's Argo reconciles it +# through the registered external cluster) # -# The static blocks (argocd-bootstrap, argocd-unraid-raw) and every comment are -# left untouched — yq edits only the named blocks in place. +# The static blocks (oci-lab's argocd-manager RBAC, unraid's argocd-bootstrap / +# argocd-unraid-raw) and every comment are left untouched — yq edits only the +# named blocks in place. # # Usage: omni/scripts/generate-manifests.sh # or: mise run oci-lab:generate-manifests / mise run unraid:generate-manifests # -# Requirements: yq (mikefarah v4), curl, helm, kubectl. Run after Cilium/Argo CD version -# bumps or appset.yaml changes, then review + commit the result. +# Requirements: yq (mikefarah v4), curl, helm, kubectl. Run after Cilium/Argo CD +# version bumps or appset.yaml changes, then review + commit the result. set -euo pipefail CLUSTER="${1:?usage: generate-manifests.sh }" @@ -22,14 +27,13 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" case "$CLUSTER" in oci-lab) - CLUSTER_TYPE="cloud" FILE="omni/cluster-templates/patches/oci-lab-inline-manifests.yaml" + WITH_ARGOCD=0 WITH_CILIUM=1 - ARGOCD_VERSION="${ARGOCD_VERSION:-v2.14.4}" ;; unraid-lab) - CLUSTER_TYPE="homelab-kvm" FILE="clusters/unraid-lab/omni/inline-manifests.yaml" + WITH_ARGOCD=1 WITH_CILIUM=0 ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.0}" ;; @@ -54,16 +58,17 @@ inject() { ' "$FILE" } -echo "==> Argo CD ${ARGOCD_VERSION} install manifest (namespaced to argocd)..." -# Upstream install.yaml carries NO namespace on its resources — it relies on -# `kubectl apply -n argocd`. Talos applies inline manifests verbatim with no -# namespace default, so the namespaced resources would miss the argocd namespace -# and never install. Stamp it with kustomize (also fixes the RBAC binding -# subjects), and prepend the Namespace since kustomize won't create it. -mkdir -p "$TMP/argocd" -curl -sfL "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml" \ - -o "$TMP/argocd/install.yaml" -cat > "$TMP/argocd/kustomization.yaml" <<'KUST' +if [[ "$WITH_ARGOCD" == 1 ]]; then + echo "==> Argo CD ${ARGOCD_VERSION} install manifest (namespaced to argocd)..." + # Upstream install.yaml carries NO namespace on its resources — it relies on + # `kubectl apply -n argocd`. Talos applies inline manifests verbatim with no + # namespace default, so the namespaced resources would miss the argocd namespace + # and never install. Stamp it with kustomize (also fixes the RBAC binding + # subjects), and prepend the Namespace since kustomize won't create it. + mkdir -p "$TMP/argocd" + curl -sfL "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml" \ + -o "$TMP/argocd/install.yaml" + cat > "$TMP/argocd/kustomization.yaml" <<'KUST' namespace: argocd resources: - install.yaml @@ -164,14 +169,14 @@ patches: requests: {cpu: 20m, memory: 64Mi} limits: {cpu: 200m, memory: 256Mi} KUST -{ printf 'apiVersion: v1\nkind: Namespace\nmetadata:\n name: argocd\n---\n'; \ - kubectl kustomize "$TMP/argocd"; } > "$TMP/argocd-manifest.yaml" -inject argocd "$TMP/argocd-manifest.yaml" + { printf 'apiVersion: v1\nkind: Namespace\nmetadata:\n name: argocd\n---\n'; \ + kubectl kustomize "$TMP/argocd"; } > "$TMP/argocd-manifest.yaml" + inject argocd "$TMP/argocd-manifest.yaml" -echo "==> appset.yaml for ${CLUSTER} / ${CLUSTER_TYPE}..." -sed -e "s/CLUSTER_NAME/${CLUSTER}/g" -e "s/CLUSTER_TYPE/${CLUSTER_TYPE}/g" \ - "$REPO_ROOT/appset.yaml" > "$TMP/appset.yaml" -inject argocd-apps "$TMP/appset.yaml" + echo "==> appset.yaml (single ApplicationSet covering unraid-lab + oci-lab)..." + cp "$REPO_ROOT/appset.yaml" "$TMP/appset.yaml" + inject argocd-apps "$TMP/appset.yaml" +fi if [[ "$WITH_CILIUM" == 1 ]]; then echo "==> Cilium ${CILIUM_VERSION} (kube-proxy-free, KubePrism)..." @@ -184,10 +189,11 @@ if [[ "$WITH_CILIUM" == 1 ]]; then --set k8sServiceHost=localhost \ --set k8sServicePort=7445 \ --set ipam.mode=kubernetes \ + --set securityContext.privileged=true \ --set hubble.relay.enabled=true \ --set hubble.ui.enabled=true \ > "$TMP/cilium.yaml" inject cilium "$TMP/cilium.yaml" fi -echo "==> Wrote ${FILE#"$REPO_ROOT"/} (${CLUSTER} / ${CLUSTER_TYPE}). Review + commit." +echo "==> Wrote ${FILE#"$REPO_ROOT"/} (${CLUSTER}). Review + commit." diff --git a/omni/scripts/inject-oci-registry-mirror.sh b/omni/scripts/inject-oci-registry-mirror.sh new file mode 100755 index 0000000..7d7c1dc --- /dev/null +++ b/omni/scripts/inject-oci-registry-mirror.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash +# Deliver OCI's Harbor registry mirrors through Omni without committing LAN +# addressing. HARBOR_REGISTRY_ENDPOINT must be a private host:port value in +# gitignored omni/secrets.env (or SECRETS_ENV); example value intentionally +# omitted. The endpoint is persisted only in Omni's encrypted config store. +set -euo pipefail + +CLUSTER="oci-lab" +YQ="${YQ:-yq}" +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" +ENV_FILE="${SECRETS_ENV:-$REPO_ROOT/omni/secrets.env}" + +[ -f "$ENV_FILE" ] || { echo "missing $ENV_FILE" >&2; exit 1; } +set -a; . "$ENV_FILE"; set +a + +ENDPOINT="${HARBOR_REGISTRY_ENDPOINT:?set in gitignored omni/secrets.env}" +case "$ENDPOINT" in + *[!A-Za-z0-9.:-]* | *://* | :* | *:) echo "HARBOR_REGISTRY_ENDPOINT must be host:port" >&2; exit 1 ;; +esac + +TMP="$(mktemp -d)" +trap 'rm -rf "$TMP"' EXIT + +cat > "$TMP/patch.yaml" < "$TMP/configpatch.yaml" < applied private Harbor registry mirror for ${CLUSTER}" +else + "$YQ" eval '.' "$TMP/configpatch.yaml" + echo "==> dry-run only; re-run with --apply to push the ConfigPatch" +fi diff --git a/omni/secrets.env.example b/omni/secrets.env.example index 5d02b72..fe02656 100644 --- a/omni/secrets.env.example +++ b/omni/secrets.env.example @@ -1,6 +1,9 @@ # Copy to omni/secrets.env (gitignored) and fill. Delivered to unraid-lab via Omni # (omni/scripts/inject-secrets.sh --apply) — never committed. HARBOR_ADMIN_PASSWORD= # choose a strong password +# Private host:port for OCI's Harbor pull-through mirror. Required only by +# omni/scripts/inject-oci-registry-mirror.sh; never commit its value. +HARBOR_REGISTRY_ENDPOINT= GITHUB_APP_ID= # syscode-labs-arc-runners App id GITHUB_APP_INSTALLATION_ID= # its installation id # The App private key PEM (multi-line). Easiest: point it at the downloaded file: