Changes for version 1.106 - 2026-08-13
- Derive api_version through @ISA for class_namespaces subclasses. IO::K8s::Role::APIObject::api_version now falls back to walking the inheritance chain when the class name itself is not in a known namespace, so a consumer subclass (e.g. `use parent 'IO::K8s::Api::Core::V1::Pod'`) serializes apiVersion instead of silently omitting it.
- Make compare_to_schema inheritance-aware. The schema comparison in IO::K8s::Role::Resource now reads the merged @ISA attribute view (_k8s_attr_info) instead of the raw registry entry, so a class_namespaces-style subclass compares its inherited attributes instead of an empty or partial set.
- Make the k8s attribute lookups class_namespaces-aware via @ISA. _k8s_attr_info and _k8s_attributes in IO::K8s::Role::Resource now walk the inheritance chain, so a consumer subclass registered through class_namespaces (e.g. `use parent 'IO::K8s::Api::Core::V1::Pod'`) inflates with typed fields and serializes its parents' attributes instead of seeing an empty registry. Attribute info merges nearest-wins (a class's own declaration overrides an inherited one, in deterministic @ISA order); the attribute list is a deduplicated union of own and inherited declarations. Both merged views are cached per class and invalidated when a new k8s attribute is registered.
- Made AutoGen dispatch apiVersion-aware and deterministic. expand_class()/inflate() with an explicit apiVersion now fall through to the openapi_spec AutoGen lookup when the resource map has no qualified key, but only for an exact group/version match in the spec's x-kubernetes-group-version-kind metadata; unknown or non-matching apiVersions fail closed (expand_class returns undef, inflate dies) instead of silently selecting a different version. Definition lookup no longer depends on hash order: versionless lookups sort candidate definitions lexicographically, exact lookups filter by group/version and croak on ambiguity. AutoGen picks a multi-GVK definition's entry by exact api_version (croak on ambiguity or no match) and deterministically sorted first otherwise, and a definition serving several versions now gets a GVK-specific package identity so two apiVersions of one definition yield distinct classes with the correct api_version method and wire serialization.
- Fix IO::K8s::List::api_version for empty lists with an item_class. The local class-name regex derived shortened, invalid wire versions for groups with a ".k8s.io" suffix (rbac/v1, storage/v1, events/v1) and serialised them into manifests. The wire version is now derived from the item_class's own api_version class method, which knows the full group (rbac.authorization.k8s.io/v1, storage.k8s.io/v1, events.k8s.io/v1); unloadable or non-API item_classes yield undef and serialised empty lists omit apiVersion again.
- Document that .pk8s manifests are Perl code executed in-process via eval and therefore must only be loaded from trusted sources, with load_yaml documented as the data-only path without code execution.
- Declared Module::Runtime as a direct runtime prerequisite. IO::K8s has always loaded it in IO::K8s (for require_module) but cpanfile and the built META omitted it, so dependency installers that resolve strictly from the declared prereqs could miss it. The built META.json now lists Module::Runtime under runtime requires.
- Made built-in Kubernetes resource dispatch exact for every addressable apiVersion/kind pair in the pinned v1.36.3 OpenAPI spec. This adds the missing events.k8s.io/v1 Event and autoscaling/v1 HorizontalPodAutoscaler routes while preserving the historical bare-name defaults (Core v1 Event and Autoscaling v2 HPA). Explicit unknown, malformed, empty, or mismatched apiVersions now fail closed: expand_class() returns undef and inflate()/new_object() report the requested Kind and apiVersion instead of silently selecting a different bare-name schema. Newly exposed compatibility aliases are ClusterTrustBundle, DeviceTaintRule, LeaseCandidate, PodGroup, ResourcePoolStatusRequest, StorageVersion, StorageVersionMigration and Workload; all existing aliases and targets remain pinned. An offline, SHA-256-pinned v1.36.3 fixture now exhaustively checks 98 addressable GVKs, all 14 multi-version Kind collisions, namespace scope, maintained non-dispatchable exceptions, real inflation and provider first-wins behavior.
- Fixed inflate()/expand_class() to dispatch by apiVersion to the correct multi-version Kind. Pre-fix, %DEFAULT_RESOURCE_MAP mapped each short Kind name (DeviceClass, ResourceClaim, ResourceClaimTemplate, ResourceSlice, ...) to exactly one class path (always the GA v1), and only entries added externally via add() ever got domain-qualified ('$apiVersion/$Kind') entries. Two visible consequences: inflate({apiVersion=>'resource.k8s.io/v1beta1', kind=>'DeviceClass', ...}) silently returned IO::K8s::Api::Resource::V1::DeviceClass (the GA class, wrong schema), and inflate of a short-name-less Kind (DeviceTaintRule, ResourcePoolStatusRequest) died with 'Cant locate IO/K8s/DeviceTaintRule.pm in @INC' because the bare IO::K8s::$Kind fallback does not exist. %DEFAULT_RESOURCE_MAP now carries literal qualified entries for every shipped version of every addressable Kind, including the short-name-less ones. Class-method and instance dispatch therefore share the same complete static map without BUILD eagerly loading every target class; add() still derives qualified keys for externally merged providers. See karr #11.
- Fixed api_version() in IO::K8s::Role::APIObject for the Storagemigration and Apiserverinternal groups. The fallback `lc($group) . '/' . $version` only produces the correct wire apiVersion for groups whose CamelCase lc-form equals the upstream group name (apps, batch, autoscaling, policy) -- for groups whose upstream name has a `.k8s.io` suffix, it produced a syntactically plausible but rejected-by-the-API-server string. In particular, every serialised StorageVersionMigration manifested as `apiVersion: storagemigration/v1beta1` (upstream: `storagemigration.k8s.io/v1beta1`) and every StorageVersion as `apiVersion: apiserverinternal/v1alpha1` (upstream: `internal.apiserver.k8s.io/v1alpha1`). Both groups are now in %API_GROUP_MAP, alongside the 13 already-mapped groups. The other 18 groups covered by %_class_prefix were audited and verified to either already map correctly or to fall through to the lc-fallback correctly (the upstream group name equals the lc form).
- Fixed _expand_class in IO::K8s::Resource to handle CamelCase prefixes (KubeAggregator, AdmissionRegistration, ...). The single-word `[A-Z][a-z]+` regex could not match a prefix that has an internal capital, so any declared class name whose first segment was CamelCase silently fell through to the IO::K8s::Api default. In practice this meant KubeAggregator's APIService, APIServiceSpec, APIServiceStatus, APIServiceCondition and ServiceReference could not be inflated -- spec/status resolved to nonexistent IO::K8s::Api::KubeAggregator::V1 classes instead of the shipped IO::K8s::KubeAggregator::Pkg::Apis:: Apiregistration::V1 ones. The lookup now walks %_class_prefix in longest-key-first order so CamelCase wins over a hypothetical shorter substring, and uses \Q ... \E so the prefix is matched as a literal rather than as a regex. Backwards-compatible: unknown short names still fall through to the IO::K8s::Api default.
- Shipped IO::K8s::Api::Apiserverinternal::V1alpha1::StorageVersionSpec. Upstream declares it as an empty struct ("StorageVersionSpec is an empty spec"), but the class was never authored, so every StorageVersion inflate died with "Can't locate .../StorageVersionSpec.pm in @INC". There was no working path through the class. This is the empty class upstream asked for; the failure mode that mattered was on the serialisation side, where an empty class round-tripped through TO_JSON could collapse to an empty hash or disappear altogether.
- Added t/34_registry_guard.t: after every shipped class is loaded, walks the global attribute registry and asserts every referenced target class is loadable. This is the regression net that would have caught the apiextensions.k8s.io/v1 union types, the KubeAggregator prefix mismatch and the missing StorageVersionSpec together, rather than one at a time on the consumer side. Inline-generated structs (packages with no .pm file) are recognised via the `k8s` symbol in the target's stash.
- Added t/32_kubeaggregator_apiservice.t and t/33_apiserverinternal_ storage_version.t covering the two regression cases above: that APIService and StorageVersion inflate, that every spec/status/ condition class resolves to the namespace shipped (not the wrong IO::K8s::Api fallback), and that the full object round-trips byte-for-byte through inflate -> TO_JSON -> inflate -> TO_JSON.
- Added t/35_expand_class.t and t/36_storage_version_spec_unit.t for direct unit coverage of the bugfix targets: every branch of Resource::_expand_class (+FullClassName, already-qualified, longest-key-first prefix walk, default fallback) and the full prefix map; and StorageVersionSpec on its own (DOES Resource, ->new, TO_JSON as an empty hash, no api_version/kind since the class intentionally does not consume IO::K8s::APIObject).
- Added the four apiextensions.k8s.io/v1 types the distribution declared but never shipped: JSON, JSONSchemaPropsOrArray, JSONSchemaPropsOrBool and JSONSchemaPropsOrStringArray. Without them, inflating any CustomResourceDefinition whose schema used `items`, `additionalItems`, `additionalProperties`, `dependencies`, `default`, `example` or `enum` died with "Can't locate IO/K8s/.../JSONSchemaPropsOrArray.pm in @INC" -- in practice nearly every real CRD, since a single array field is enough to hit it. All four are Kubernetes union types that serialize as the bare alternative rather than as a tagged wrapper, so which arm was used now survives a round trip: `additionalProperties: false` stays false instead of collapsing into an empty schema object, and a single `items` schema does not turn into a one-element array.
- Added a FROM_STRUCT inflation hook to struct_to_object. A class that provides this class method takes over its own inflation completely and owns its TO_JSON in return, instead of being built field by field from a hashref. This is what makes the union types above representable; it is the general mechanism for any type that serializes as a bare value.
- Shipped resource.k8s.io/v1beta1 (39 classes, entirely missing -- lib/IO/K8s/Api/Resource/ had no V1beta1/ directory at all) and filled in resource.k8s.io/v1beta2 (39 more classes; only the DeviceTaintRule/ DeviceTaintRuleSpec/DeviceTaintRuleStatus/DeviceTaintSelector quartet from an earlier fix was shipped there). Both versions now carry the full DRA surface: DeviceClass, ResourceClaim, ResourceClaimTemplate and ResourceSlice (DeviceClass/ResourceSlice cluster scoped, ResourceClaim/ ResourceClaimTemplate namespaced -- verified against the real swagger paths, not just pattern-matched from V1) plus the whole Device/ AllocationResult/DeviceRequest/Counter/CapacityRequestPolicy family. v1beta1 is the most widely deployed DRA server version; any consumer talking to a cluster that had not migrated to v1 got "Can't locate .../DeviceClass.pm in @INC" for every one of these Kinds.
- Added the 9 v1.36 DRA additions to resource.k8s.io/v1alpha3 that had not been backported to the legacy "classic DRA" version also serving them: DeviceTaint, DeviceTaintRule (+ Spec/Status), DeviceTaintSelector, PoolStatus, and ResourcePoolStatusRequest (+ Spec/Status) -- the latter three were already present from a previous pass; only the DeviceTaint(Rule) family was actually missing. The 24 already-shipped "classic DRA" structural types (DeviceClass, ResourceClaim, Device, AllocationResult, etc.) are untouched, per the 1.100/1.105 decision to keep them as legacy backward compatibility.
- Fixed ArrayRef[Bool] fields (DeviceAttribute.bools, present in the V1, V1beta1 and V1beta2 DRA APIs) to serialize as JSON booleans instead of plain 0/1, and to accept real decoded JSON booleans on the way back in. Previously TO_JSON emitted [1,0,1] instead of [true,false,true], and FROM_HASH on a real cluster response died with a Moo type constraint violation because JSON::PP::Boolean objects don't satisfy Types:: Standard's Bool -- this affected the already-shipped IO::K8s::Api::Resource::V1::DeviceAttribute too, not just the new v1beta1/v1beta2 copies. IO::K8s::Resource now tracks an is_array_of_bool flag with element-wise coercion, mirroring the existing scalar Bool handling.
- Fixed ResourceClaimTemplateSpec (v1beta1 and v1beta2) to be built on IO::K8s::APIObject instead of IO::K8s::Resource, matching the already- shipped V1 sibling. Despite not being a Kind, it carries a real upstream `metadata: ObjectMeta` field; without APIObject the metadata attribute was never registered and silently dropped on serialization.
- Added maint/spec-drift-check.pl, a repeatable coverage checker that diffs a real upstream swagger.json against what lib/IO/K8s/ actually ships and reports missing Kinds/types/fields (the tool behind karr #4-#8's discovery), plus a --from/--to mode that diffs two upstream releases directly to gauge whether a version bump is worth doing. Settled non-gaps (dropped *List kinds, old back-compat API tracks, apimachinery scalar/opaque types) are filtered via the maintained maint/spec-drift-exceptions.yaml. Report-only: never edits lib/ or the karr board.
- Shipped storagemigration.k8s.io/v1beta1 (IO::K8s::Api::Storagemigration:: V1beta1::StorageVersionMigration, ::StorageVersionMigrationSpec and ::StorageVersionMigrationStatus), the version v1.36 clusters actually serve now that v1alpha1 has been dropped from the upstream spec. The existing V1alpha1 classes are untouched and stay shipped for old-cluster back-compat. Also added IO::K8s::Apimachinery::Pkg::Apis::Meta::V1:: GroupResource, which StorageVersionMigrationSpec.resource needs and which did not exist under any group.
- Added five Core::V1 classes that existing structs gained a new $ref field for in v1.36, but whose target type was never shipped, silently swallowing the field on inflate: FileKeySelector (EnvVarSource. fileKeyRef -- read an env var's value from a file in the container), NodeSwapStatus (NodeSystemInfo.swap), PodCertificateProjection (VolumeProjection.podCertificate), and VolumeStatus + ImageVolumeStatus (VolumeMountStatus.volumeStatus).
- Added t/38_storagemigration_v1beta1_and_core_v136_fields.t covering the two fixes above: a full StorageVersionMigration inflate -> TO_JSON -> inflate round-trip through GroupResource, plus round-trips for EnvVarSource.fileKeyRef, VolumeMountStatus.volumeStatus, NodeSystemInfo. swap and VolumeProjection.podCertificate.
- Added 14 fields the v1.36 sync had missed on otherwise-shipped classes: Core::V1::ContainerStatus.stopSignal, Core::V1::Lifecycle.stopSignal, Core::V1::PodCondition.observedGeneration, Core::V1:: PodSecurityContext.seLinuxChangePolicy, Core::V1::ResourceHealth.message, Storage::V1::VolumeError.errorCode, ApiextensionsApiserver::...::V1:: CustomResourceDefinitionCondition.observedGeneration and :: CustomResourceDefinitionStatus.observedGeneration, Apimachinery::...:: Meta::V1::DeleteOptions.ignoreStoreReadErrorWithClusterBreakingPotential, and Apimachinery::Pkg::Version::Info.emulationMajor/emulationMinor/ minCompatibilityMajor/minCompatibilityMinor. Also shipped the new IO::K8s::Apimachinery::Pkg::Apis::Meta::V1::ShardInfo struct and wired it up as ListMeta.shardInfo, which previously had no target type at all.
- Shipped coordination.k8s.io/v1alpha2 (IO::K8s::Api::Coordination:: V1alpha2::LeaseCandidate and ::LeaseCandidateSpec), which had no directory at all despite V1, V1alpha1 and V1beta1 all being shipped. Also added IO::K8s::Api::Scheduling::V1alpha2::TypedLocalObjectReference, a distinct upstream schema that WorkloadSpec.controllerRef previously pointed at Core::V1::TypedLocalObjectReference for instead -- the two happen to share the same three fields today, but they are different schemas and were drifting apart silently.
- Added the meta.v1 discovery Kinds APIGroupList and APIResourceList (IO::K8s::Apimachinery::Pkg::Apis::Meta::V1::), used by the /apis and /apis/<group> discovery endpoints. Modelled like their already-shipped siblings APIGroup/APIVersions/Status/DeleteOptions: explicit apiVersion/ kind Str fields, not IO::K8s::APIObject.
- Added t/39_v1_36_field_and_kind_gaps.t covering all of the above: field round-trips for a representative sample of the 14 additions, a full LeaseCandidate inflate -> TO_JSON -> inflate round-trip, the corrected WorkloadSpec.controllerRef target class, and APIGroupList/ APIResourceList loading with their required fields passed through.
Modules
Objects representing things found in the Kubernetes API
Base class for top-level Kubernetes API objects
AgentSandbox CRD resource map provider for IO::K8s
Isolated runtime environment for AI agents
Request for sandbox allocation
Reusable sandbox configuration template
Pre-warmed pool of sandbox instances
Isolated runtime environment for AI agents
Request for sandbox allocation from a warm pool
Reusable sandbox configuration template
Pre-warmed pool of sandbox instances
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
MutatingWebhook describes an admission webhook and the resources and operations it applies to.
MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.
ServiceReference holds a reference to Service.legacy.k8s.io
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
WebhookClientConfig contains the information to make a TLS connection with the webhook
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of a ValidatingAdmissionPolicy.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition.
ApplyConfiguration defines the desired configuration values of an object.
AuditAnnotation describes how to produce an audit annotation for an API request.
ExpressionWarning is a warning information that targets a specific expression.
JSONPatch defines a JSON Patch.
MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.
MutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.
MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.
MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.
Mutation specifies the CEL expression which is used to apply the Mutation.
NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
ParamKind is a tuple of Group Kind and Version.
ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.
TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicy
ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.
Validation specifies the CEL expression which is used to apply the validation.
Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.
An API server instance reports the version it can decode and the version it encodes objects to when persisting objects in the backend.
Storage version of a specific resource.
Describes the state of the storageVersion at a certain point.
StorageVersionSpec is an empty spec.
API server instances report the versions they can decode and the version they encode objects to when persisting objects in the backend.
ControllerRevision implements an immutable snapshot of state data.
DaemonSet represents the configuration of a daemon set.
DaemonSetCondition describes the state of a DaemonSet at a certain point.
DaemonSetSpec is the specification of a daemon set.
DaemonSetStatus represents the current status of a daemon set.
DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.
Deployment enables declarative updates for Pods and ReplicaSets.
DeploymentCondition describes the state of a deployment at a certain point.
DeploymentSpec is the specification of the desired behavior of the Deployment.
DeploymentStatus is the most recently observed status of the Deployment.
DeploymentStrategy describes how to replace existing pods with new ones.
ReplicaSet ensures that a specified number of pod replicas are running at any given time.
ReplicaSetCondition describes the state of a replica set at a certain point.
ReplicaSetSpec is the specification of a ReplicaSet.
ReplicaSetStatus represents the current status of a ReplicaSet.
Spec to control the desired behavior of daemon set rolling update.
Spec to control the desired behavior of rolling update.
RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
StatefulSet represents a set of pods with consistent identities.
StatefulSetCondition describes the state of a statefulset at a certain point.
StatefulSetOrdinals describes the policy used for replica ordinal assignment in this StatefulSet.
StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from the StatefulSet VolumeClaimTemplates.
A StatefulSetSpec is the specification of a StatefulSet.
StatefulSetStatus represents the current state of a StatefulSet.
StatefulSetUpdateStrategy indicates the strategy that the StatefulSet controller will use to perform updates.
BoundObjectReference is a reference to an object that a token is bound to.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
TokenRequest requests a token for a given service account.
TokenRequestSpec contains client provided parameters of a token request.
TokenRequestStatus is the result of a token request.
TokenReview attempts to authenticate a token to a known user. Note: TokenReview requests may be cached by the webhook token authenticator plugin in the kube-apiserver.
TokenReviewSpec is a description of the token authentication request.
TokenReviewStatus is the result of the token authentication request.
UserInfo holds the information about the user needed to implement the user.Info interface.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request. When using impersonation, users will receive the user info of the user being impersonated. If impersonation or request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.
NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
NonResourceRule holds information that describes a rule for the non-resource
ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
SelfSubjectAccessReview checks whether or the current user can perform an action. Not filling in a spec.namespace means "in all namespaces". Self is a special case, because users should always be able to check whether they can perform an action
SelfSubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set
SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace. The returned list of actions may be incomplete depending on the server's authorization mode, and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions, or to quickly let an end user reason about their permissions. It should NOT Be used by external systems to drive authorization decisions as this raises confused deputy, cache lifetime/revocation, and correctness concerns. SubjectAccessReview, and LocalAccessReview are the correct way to defer authorization decisions to the API server.
SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
SubjectAccessReview checks whether or not a user or group can perform an action.
SubjectAccessReviewSpec is a description of the access request. Exactly one of ResourceAuthorizationAttributes and NonResourceAuthorizationAttributes must be set
SubjectAccessReviewStatus
SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.
CrossVersionObjectReference contains enough information to let you identify the referred resource.
configuration of a horizontal pod autoscaler.
specification of a horizontal pod autoscaler.
current status of a horizontal pod autoscaler
Scale represents a scaling request for a resource.
ScaleSpec describes the attributes of a scale subresource.
ScaleStatus represents the current status of a scale subresource.
ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.
ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
CrossVersionObjectReference contains enough information to let you identify the referred resource.
ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.
HPAScalingPolicy is a single policy which must hold true for a specified past interval.
HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.
HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.
HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).
HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.
HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.
HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.
MetricIdentifier defines the name and optionally selector for a metric
MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).
MetricStatus describes the last-read state of a single metric.
MetricTarget defines the target value, average value, or average utilization of a specific metric
MetricValueStatus holds the current value for a metric
ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).
ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).
PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).
ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.
ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
CronJob represents the configuration of a single cron job.
CronJobSpec describes how the job execution will look like and when it will actually run.
CronJobStatus represents the current state of a cron job.
Job represents the configuration of a single job.
JobCondition describes current state of a job.
JobSpec describes how the job execution will look like.
JobStatus represents the current state of a Job.
JobTemplateSpec describes the data a Job should have when created from a template
PodFailurePolicy describes how failed pods influence the backoffLimit.
PodFailurePolicyOnExitCodesRequirement describes the requirement for handling a failed pod based on its container exit codes. In particular, it lookups the .state.terminated.exitCode for each app container and init container status, represented by the .status.containerStatuses and .status.initContainerStatuses fields in the Pod status, respectively. Containers completed with success (exit code 0) are excluded from the requirement check.
PodFailurePolicyOnPodConditionsPattern describes a pattern for matching an actual pod condition type.
PodFailurePolicyRule describes how a pod failure is handled when the requirements are met. One of onExitCodes and onPodConditions, but not both, can be used in each rule.
SuccessPolicy describes when a Job can be declared as succeeded based on the success of some indexes.
SuccessPolicyRule describes rule for declaring a Job as succeeded. Each rule must have at least one of the "succeededIndexes" or "succeededCount" specified.
UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't been accounted in Job status counters.
CertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.
CertificateSigningRequestCondition describes a condition of a CertificateSigningRequest object
CertificateSigningRequestSpec contains the certificate request.
CertificateSigningRequestStatus contains conditions used to indicate approved/denied/failed status of the request, and the issued certificate.
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
ClusterTrustBundleSpec contains the signer and trust anchors.
ClusterTrustBundle is a cluster-scoped container for X.509 trust anchors (root certificates).
ClusterTrustBundleSpec contains the signer and trust anchors.
PodCertificateRequest encapsulates a pod's request for a certificate from a signer, as well as the signer's response, if any.
PodCertificateRequestSpec describes the certificate request. All fields are immutable after creation.
PodCertificateRequestStatus describes the status of the request, and holds the certificate data if the request is issued.
Lease defines a lease concept.
LeaseSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
LeaseCandidate defines a candidate for a Lease object. Candidates are created such that coordinated leader election will pick the best leader from the list of candidates.
LeaseCandidateSpec is a specification of a Lease.
Represents a Persistent Disk resource in AWS. An AWS EBS disk must exist before mounting to a container. The disk must also be in the same AWS zone as the kubelet. An AWS EBS disk can only be mounted as read/write once. AWS EBS volumes support ownership management and SELinux relabeling.
Affinity is a group of affinity scheduling rules.
AppArmorProfile defines a pod or container's AppArmor settings.
AttachedVolume describes a volume attached to a node
AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
Binding ties one object to another; for example, a pod is bound to a node by a scheduler. Deprecated in 1.7, please use the bindings subresource of pods instead.
Represents storage that is managed by an external CSI volume driver (Beta feature)
Represents a source location of a volume to mount, managed by an external CSI driver
Adds and removes POSIX capabilities from running containers.
Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.
Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.
Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.
Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.
ClientIPConfig represents the configurations of Client IP based session affinity.
ClusterTrustBundleProjection describes how to select a set of ClusterTrustBundle objects and project their contents into the pod filesystem.
Information about the condition of a component.
ComponentStatus (and ComponentStatusList) holds the cluster validation info. Deprecated: This API is deprecated in v1.19+
ConfigMap holds configuration data for pods to consume.
ConfigMapEnvSource selects a ConfigMap to populate the environment variables with. The contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.
Selects a key from a ConfigMap.
ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration
Adapts a ConfigMap into a projected volume. The contents of the target ConfigMap's Data field will be presented in a projected volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. Note that this is identical to a configmap volume source without the default mode.
Adapts a ConfigMap into a volume. The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. ConfigMap volumes support ownership management and SELinux relabeling.
A single application container that you want to run within a pod.
ContainerExtendedResourceRequest has the mapping of container name, extended resource name to the device request name.
Describe a container image
ContainerPort represents a network port in a single container.
ContainerResizePolicy represents resource resize policy for the container.
ContainerRestartRule describes how a container exit is handled.
ContainerRestartRuleOnExitCodes describes the condition for handling an exited container based on its exit codes.
ContainerState holds a possible state of container. Only one of its members may be specified. If none of them is specified, the default one is ContainerStateWaiting.
ContainerStateRunning is a running state of a container.
ContainerStateTerminated is a terminated state of a container.
ContainerStateWaiting is a waiting state of a container.
ContainerStatus contains details for the current status of this container.
ContainerUser represents user identity information
DaemonEndpoint contains information about a single Daemon endpoint.
Represents downward API info for projecting into a projected volume. Note that this is identical to a downwardAPI volume source without the default mode.
DownwardAPIVolumeFile represents information to create the file containing the pod field
DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.
Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.
EndpointAddress is a tuple that describes single IP address.
EndpointPort is a tuple that describes a single port.
EndpointSubset is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports.
Endpoints is a collection of endpoints that implement the actual service.
EnvFromSource represents the source of a set of ConfigMaps
EnvVar represents an environment variable present in a Container.
EnvVarSource represents a source for the value of an EnvVar.
An EphemeralContainer is a temporary container that you may add to an existing Pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a Pod is removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation. To add an ephemeral container, use the ephemeralcontainers subresource of an existing Pod. Ephemeral containers may not be removed or restarted.
Represents an ephemeral volume that is handled by a normal storage driver.
Event is a report of an event somewhere in the cluster. Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason. Events should be treated as informative, best-effort, supplemental data.
EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time.
EventSource contains information for an event.
ExecAction describes a "run in container" action.
Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.
FileKeySelector selects a key of the env file.
FlexPersistentVolumeSource represents a generic persistent volume resource that is provisioned/attached using an exec based plugin.
FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.
Represents a Flocker volume mounted by the Flocker agent. One and only one of datasetName and datasetUUID should be set. Flocker volumes do not support ownership management or SELinux relabeling.
Represents a Persistent Disk resource in Google Compute Engine. A GCE PD must exist before mounting to a container. The disk must also be in the same GCE project and zone as the kubelet. A GCE PD can only be mounted as read/write once or read-only many times. GCE PDs support ownership management and SELinux relabeling.
Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling. DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.
Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.
Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.
HTTPGetAction describes an action based on HTTP Get requests.
HTTPHeader describes a custom header to be used in HTTP probes
HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.
HostIP represents a single IP address allocated to the host.
Represents a host path mapped into a pod. Host path volumes do not support ownership management or SELinux relabeling.
ISCSIPersistentVolumeSource represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.
Represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.
ImageVolumeSource represents a image volume resource.
ImageVolumeStatus represents the image-based volume status.
Maps a string key to a path within a volume.
Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.
LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified.
LimitRange sets resource usage limits for each kind of resource in a Namespace.
LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
LimitRangeSpec defines a min/max usage limit for resources that match on kind.
LinuxContainerUser represents user identity information in Linux containers
LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.
LoadBalancerStatus represents the status of a load-balancer.
LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.
Local represents directly-attached storage with node affinity (Beta feature)
ModifyVolumeStatus represents the status object of ControllerModifyVolume operation
Represents an NFS mount that lasts the lifetime of a pod. NFS volumes do not support ownership management or SELinux relabeling.
Namespace provides a scope for Names. Use of multiple namespaces is optional.
NamespaceCondition contains details about state of namespace.
NamespaceSpec describes the attributes on a Namespace.
NamespaceStatus is information about the current status of a Namespace.
Node is a worker node in Kubernetes. Each node will have a unique identifier in the cache (i.e. in etcd).
NodeAddress contains information for the node's address.
Node affinity is a group of node affinity scheduling rules.
NodeAllocatableResourceClaimStatus tracks the status of node-allocatable resources allocated to a ResourceClaim for a Pod.
NodeCondition contains condition information for a node.
NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22
NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.
NodeDaemonEndpoints lists ports opened by daemons running on the Node.
NodeFeatures describes the set of features implemented by the CRI implementation. The features contained in the NodeFeatures should depend only on the cri implementation independent of runtime handlers.
NodeRuntimeHandler is a set of runtime handler information.
NodeRuntimeHandlerFeatures is a set of features implemented by the runtime handler.
A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.
A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
NodeSpec describes the attributes that a node is created with.
NodeStatus is information about the current status of a node.
NodeSwapStatus represents swap memory information.
NodeSystemInfo is a set of ids/uuids to uniquely identify the node.
ObjectFieldSelector selects an APIVersioned field of an object.
ObjectReference contains enough information to let you inspect or modify the referred object.
PersistentVolume (PV) is a storage resource provisioned by an administrator. It is analogous to a node. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
PersistentVolumeClaim is a user's request for and claim to a persistent volume
PersistentVolumeClaimCondition contains details about state of pvc
PersistentVolumeClaimSpec describes the common attributes of storage devices and allows a Source for provider-specific attributes
PersistentVolumeClaimStatus is the current status of a persistent volume claim.
PersistentVolumeClaimTemplate is used to produce PersistentVolumeClaim objects as part of an EphemeralVolumeSource.
PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another type of volume that is owned by someone else (the system).
PersistentVolumeSpec is the specification of a persistent volume.
PersistentVolumeStatus is the current status of a persistent volume.
Represents a Photon Controller persistent disk resource.
Pod is a collection of containers that can run on a host. This resource is created by clients and scheduled onto hosts.
Pod affinity is a group of inter pod affinity scheduling rules.
Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running
Pod anti affinity is a group of inter pod anti affinity scheduling rules.
PodCertificateProjection provides a private key and X.509 certificate in the pod filesystem.
PodCondition contains details for the current condition of this pod.
PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy.
PodDNSConfigOption defines DNS resolver options of a pod.
PodExtendedResourceClaimStatus is stored in the PodStatus for the extended resources backed by DRA. It stores the generated name for the corresponding special ResourceClaim created by the scheduler.
PodIP represents a single IP address allocated to the pod.
PodOS defines the OS parameters of a pod.
PodReadinessGate contains the reference to a pod condition
PodResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the pod. It adds a name to it that uniquely identifies the ResourceClaim inside the Pod. Containers that need access to the ResourceClaim reference it with this name.
PodResourceClaimStatus is stored in the PodStatus for each PodResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodSchedulingGate is associated to a Pod to guard its scheduling.
PodSchedulingGroup is used to associate a Pod with the PodGroup runtime instance it belongs to for gang-scheduling purposes.
PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.
PodSpec is a description of a pod.
PodStatus represents information about the status of a pod. Status may trail the actual state of a system, especially if the node that hosts the pod cannot contact the control plane.
PodTemplate describes a template for creating copies of a predefined pod.
PodTemplateSpec describes the data a pod should have when created from a template
PortworxVolumeSource represents a Portworx volume resource.
An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.
Represents a projected volume source
Represents a Quobyte mount that lasts the lifetime of a pod. Quobyte volumes do not support ownership management or SELinux relabeling.
Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.
Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.
ReplicationController represents the configuration of a replication controller.
ReplicationControllerCondition describes the state of a replication controller at a certain point.
ReplicationControllerSpec is the specification of a replication controller.
ReplicationControllerStatus represents the current status of a replication controller.
ResourceClaim references one entry in PodSpec.ResourceClaims.
ResourceFieldSelector represents container resources (cpu, memory) and their output format
ResourceHealth represents the health of a resource. It has the latest device health information. This is a part of KEP https://kep.k8s.io/4680 and historical health changes are planned to be added in future iterations of a KEP.
ResourceQuota sets aggregate quota restrictions enforced per namespace
ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
ResourceQuotaStatus defines the enforced hard limits and observed use.
ResourceRequirements describes the compute resource requirements.
SELinuxOptions are the labels to be applied to the container
ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
ScaleIOVolumeSource represents a persistent ScaleIO volume
A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.
A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.
SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.
Secret holds secret data of a certain type. The total bytes of the values in the Data field must be less than MaxSecretSize bytes.
SecretEnvSource selects a Secret to populate the environment variables with. The contents of the target Secret's Data field will represent the key-value pairs as environment variables.
SecretKeySelector selects a key of a Secret.
Adapts a secret into a projected volume. The contents of the target Secret's Data field will be presented in a projected volume as files using the keys in the Data field as the file names. Note that this is identical to a secret volume source without the default mode.
SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
Adapts a Secret into a volume. The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.
SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.
Service is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.
ServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets
ServiceAccountTokenProjection represents a projected service account token volume. This projection can be used to insert a service account token into the pods runtime filesystem for use against APIs (Kubernetes API Server or otherwise).
ServicePort contains information on service's port.
ServiceSpec describes the attributes that a user creates on a service.
ServiceStatus represents the current status of a service.
SessionAffinityConfig represents the configurations of session affinity.
SleepAction describes a "sleep" action.
Represents a StorageOS persistent volume resource.
Represents a StorageOS persistent volume resource.
Sysctl defines a kernel parameter to be set
TCPSocketAction describes an action based on opening a socket
The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint.
The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
A topology selector requirement is a selector that matches given label. This is an alpha feature and may change in the future.
A topology selector term represents the result of label queries. A null or empty topology selector term matches no objects. The requirements of them are ANDed. It provides a subset of functionality as NodeSelectorTerm. This is an alpha feature and may change in the future.
TopologySpreadConstraint specifies how to spread matching pods among the given topology.
TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.
Volume represents a named volume in a pod that may be accessed by any container in the pod.
volumeDevice describes a mapping of a raw block device within a container.
VolumeMount describes a mounting of a Volume within a container.
VolumeMountStatus shows status of volume mounts.
VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.
Projection that may be projected along with other supported volume types. Exactly one of these fields must be set.
VolumeResourceRequirements describes the storage resource requirements for a volume.
VolumeStatus represents the status of a mounted volume. At most one of its members must be specified.
Represents a vSphere volume resource.
The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
WindowsSecurityContextOptions contain Windows-specific options and credentials.
Endpoint represents a single logical "backend" implementing a service.
EndpointConditions represents the current condition of an endpoint.
EndpointHints provides hints describing how an endpoint should be consumed.
EndpointPort represents a Port used by an EndpointSlice
EndpointSlice represents a subset of the endpoints that implement a service. For a given service there may be multiple EndpointSlice objects, selected by labels, which must be joined to produce the full set of endpoints.
ForNode provides information about which nodes should consume this endpoint.
ForZone provides information about which zones should consume this endpoint.
Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system. Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason. Events should be treated as informative, best-effort, supplemental data.
EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time. How often to update the EventSeries is up to the event reporters. The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows how this struct is updated on heartbeats and can guide customized reporter implementations.
ExemptPriorityLevelConfiguration describes the configurable aspects of the handling of exempt requests. In the mandatory exempt configuration object the values in the fields here can be modified by authorized users, unlike the rest of the `spec`.
FlowDistinguisherMethod specifies the method of a flow distinguisher.
FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
FlowSchemaCondition describes conditions for a FlowSchema.
FlowSchemaSpec describes how the FlowSchema's specification looks like.
FlowSchemaStatus represents the current state of a FlowSchema.
GroupSubject holds detailed information for group-kind subject.
LimitResponse defines how to handle requests that can not be executed right now.
LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues: How are requests for this priority level limited? What should be done with requests that exceed the limit?
NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.
PriorityLevelConfiguration represents the configuration of a priority level.
PriorityLevelConfigurationCondition defines the condition of priority level.
PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.
PriorityLevelConfigurationSpec specifies the configuration of a priority level.
PriorityLevelConfigurationStatus represents the current state of a "request-priority".
QueuingConfiguration holds the configuration parameters for queuing.
ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==""`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.
ServiceAccountSubject holds detailed information for service-account-kind subject.
Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.
UserSubject holds detailed information for user-kind subject.
ExemptPriorityLevelConfiguration describes the configurable aspects of the handling of exempt requests. In the mandatory exempt configuration object the values in the fields here can be modified by authorized users, unlike the rest of the spec.
FlowDistinguisherMethod specifies the method of a flow distinguisher.
FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".
FlowSchemaCondition describes conditions for a FlowSchema.
FlowSchemaSpec describes how the FlowSchema's specification looks like.
FlowSchemaStatus represents the current state of a FlowSchema.
GroupSubject holds detailed information for group-kind subject.
LimitResponse defines how to handle requests that can not be executed right now.
LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues: How are requests for this priority level limited? What should be done with requests that exceed the limit?
NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.
PriorityLevelConfiguration represents the configuration of a priority level.
PriorityLevelConfigurationCondition defines the condition of priority level.
PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.
PriorityLevelConfigurationSpec specifies the configuration of a priority level.
PriorityLevelConfigurationStatus represents the current state of a "request-priority".
QueuingConfiguration holds the configuration parameters for queuing.
ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., Namespace=="") and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.
ServiceAccountSubject holds detailed information for service-account-kind subject.
Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.
UserSubject holds detailed information for user-kind subject.
HTTPIngressPath associates a path with a backend. Incoming urls matching the path are forwarded to the backend.
HTTPIngressRuleValue is a list of http selectors pointing to backends. In the example: http://<host>/<path>?<searchpart> -> backend where where parts of the url correspond to RFC 3986, this resource will be used to match against everything after the last '/' and before the first '?' or '#'.
IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
IPAddressSpec describe the attributes in an IP Address.
IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.
Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.
IngressBackend describes all endpoints for a given service and port.
IngressClass represents the class of the Ingress, referenced by the Ingress Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be used to indicate that an IngressClass should be considered default. When a single IngressClass resource has this annotation set to true, new Ingress resources without a class specified will be assigned this default class.
IngressClassParametersReference identifies an API object. This can be used to specify a cluster or namespace-scoped resource.
IngressClassSpec provides information about the class of an Ingress.
IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
IngressLoadBalancerStatus represents the status of a load-balancer.
IngressPortStatus represents the error condition of a service port
IngressRule represents the rules mapping the paths under a specified host to the related backend services. Incoming requests are first evaluated for a host match, then routed to the backend associated with the matching IngressRuleValue.
IngressServiceBackend references a Kubernetes Service as a Backend.
IngressSpec describes the Ingress the user wishes to exist.
IngressStatus describe the current state of the Ingress.
IngressTLS describes the transport layer security associated with an ingress.
NetworkPolicy describes what network traffic is allowed for a set of Pods
NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8
NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed
NetworkPolicyPort describes a port to allow traffic on
NetworkPolicySpec provides the specification of a NetworkPolicy
ParentReference describes a reference to a parent object.
ServiceBackendPort is the service port being referenced.
ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.
ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
ServiceCIDRStatus describes the current state of the ServiceCIDR.
IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses. An IP address can be represented in different formats, to guarantee the uniqueness of the IP, the name of the object is the IP address in canonical format, four decimal digits separated by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6. Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1 Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
IPAddressSpec describe the attributes in an IP Address.
ParentReference describes a reference to a parent object.
ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64). This range is used to allocate ClusterIPs to Service objects.
ServiceCIDRSpec define the CIDRs the user wants to use for allocating ClusterIPs for Services.
ServiceCIDRStatus describes the current state of the ServiceCIDR.
Overhead structure represents the resource overhead associated with running a pod.
RuntimeClass defines a class of container runtime supported in the cluster. The RuntimeClass is used to determine which container runtime is used to run all containers in a pod. RuntimeClasses are manually defined by a user or cluster provisioner, and referenced in the PodSpec. The Kubelet is responsible for resolving the RuntimeClassName reference before running the pod. For more details, see https://kubernetes.io/docs/concepts/containers/runtime-class/
Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.
Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod. A request to cause such an eviction is created by POSTing to .../pods/<pod name>/evictions.
PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods
PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system.
AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject.
PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.
Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.
RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace.
RoleRef contains information that points to the role being used
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. DeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.
The device this taint is attached to has the effect on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple using the matching operator.
ExactDeviceRequest is a request for one or more identical devices.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
AllocationResult contains attributes of an allocated resource.
BasicDevice defines one device instance.
CELDeviceSelector contains a CEL expression for selecting a device.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. A DeviceClassName is currently required. Clients must check that it is indeed set. It's absence indicates that something changed in a way that is not supported by the client yet, in which case it must refuse to handle the request.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.
DeviceTaintRuleSpec specifies the selector and one taint.
DeviceTaintRuleStatus provides information about an on-going pod eviction.
DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
PoolStatus contains status information for a single resource pool.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourcePoolStatusRequest triggers a one-time calculation of resource pool status based on the provided filters. Once status is set, the request is considered complete and will not be reprocessed. Users should delete and recreate requests to get updated information.
ResourcePoolStatusRequestSpec defines the filters for the pool status request.
ResourcePoolStatusRequestStatus contains the calculated pool status information.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
BasicDevice defines one device instance.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values. - If the requested amount is less than Min, it is rounded up to the Min value. - If Step is set and the requested amount is between Min and Max but not aligned with Step, it will be rounded up to the next value equal to Min + (n * Step). - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set). - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy, and the device cannot be allocated.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool. The counters are not allocatable by themselves, but can be referenced by devices. When a device is allocated, the portion of counters it uses will no longer be available for use by other devices.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices. DeviceSubRequest is similar to Request, but doesn't expose the AdminAccess or FirstAvailable fields, as those can only be set on the top-level request. AdminAccess is not supported for requests with a prioritized list, and recursive FirstAvailable fields are not supported.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
AllocatedDeviceStatus contains the status of an allocated device, if the driver chooses to report it. This may include driver-specific information. The combination of Driver, Pool, Device, and ShareID must match the corresponding key in Status.Allocation.Devices.
AllocationResult contains attributes of an allocated resource.
CELDeviceSelector contains a CEL expression for selecting a device.
CapacityRequestPolicy defines how requests consume device capacity. Must not set more than one ValidRequestValues.
CapacityRequestPolicyRange defines a valid range for consumable capacity values. - If the requested amount is less than Min, it is rounded up to the Min value. - If Step is set and the requested amount is between Min and Max but not aligned with Step, it will be rounded up to the next value equal to Min + (n * Step). - If Step is not set, the requested amount is used as-is if it falls within the range Min to Max (if set). - If the requested or rounded amount exceeds Max (if set), the request does not satisfy the policy, and the device cannot be allocated.
CapacityRequirements defines the capacity requirements for a specific device request.
Counter describes a quantity associated with a device.
CounterSet defines a named set of counters that are available to be used by devices defined in the ResourcePool. The counters are not allocatable by themselves, but can be referenced by devices. When a device is allocated, the portion of counters it uses will no longer be available for use by other devices.
Device represents one individual hardware instance that can be selected based on its attributes. Besides the name, exactly one field must be set.
DeviceAllocationConfiguration gets embedded in an AllocationResult.
DeviceAllocationResult is the result of allocating devices.
DeviceAttribute must have exactly one field set.
DeviceCapacity describes a quantity associated with a device.
DeviceClaim defines how to request devices with a ResourceClaim.
DeviceClaimConfiguration is used for configuration parameters in DeviceClaim.
DeviceClass is a vendor- or admin-provided resource that contains device configuration and selectors. It can be referenced in the device requests of a claim to apply these presets. Cluster scoped. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
DeviceClassConfiguration is used in DeviceClass.
DeviceClassSpec is used in a [DeviceClass] to define what can be allocated and how to configure it.
DeviceConstraint must have exactly one field set besides Requests.
DeviceCounterConsumption defines a set of counters that a device will consume from a CounterSet.
DeviceRequest is a request for devices required for a claim. This is typically a request for a single resource like a device, but can also ask for several identical devices. With FirstAvailable it is also possible to provide a prioritized list of requests.
DeviceRequestAllocationResult contains the allocation result for one request.
DeviceSelector must have exactly one field set.
DeviceSubRequest describes a request for device provided in the claim.spec.devices.requests[].firstAvailable array. Each is typically a request for a single resource like a device, but can also ask for several identical devices. DeviceSubRequest is similar to ExactDeviceRequest, but doesn't expose the AdminAccess field as that one is only supported when requesting a specific device.
The device this taint is attached to has the "effect" on any claim which does not tolerate the taint and, through the claim, to pods using the claim.
DeviceTaintRule adds one taint to all devices which match the selector. This has the same effect as if the taint was specified directly in the ResourceSlice by the DRA driver.
DeviceTaintRuleSpec specifies the selector and one taint.
DeviceTaintRuleStatus provides information about an on-going pod eviction.
DeviceTaintSelector defines which device(s) a DeviceTaintRule applies to. The empty selector matches all devices. Without a selector, no devices are matched.
The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.
ExactDeviceRequest is a request for one or more identical devices.
NetworkDeviceData provides network-related details for the allocated device. This information may be filled by drivers or other components to configure or identify the device within a network context.
NodeAllocatableResourceMapping defines the translation between the DRA device/capacity units requested to the corresponding quantity of the node allocatable resource.
OpaqueDeviceConfiguration contains configuration parameters for a driver in a format defined by the driver vendor.
ResourceClaim describes a request for access to resources in the cluster, for use by workloads. For example, if a workload needs an accelerator device with specific properties, this is how that request is expressed. The status stanza tracks whether this claim has been satisfied and what specific resources have been allocated. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.
ResourceClaimSpec defines what is being requested in a ResourceClaim and how to configure it.
ResourceClaimStatus tracks whether the resource has been allocated and what the result of that was.
ResourceClaimTemplate is used to produce ResourceClaim objects. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.
ResourcePool describes the pool that ResourceSlices belong to.
ResourceSlice represents one or more resources in a pool of similar resources, managed by a common driver. A pool may span more than one ResourceSlice, and exactly how many ResourceSlices comprise a pool is determined by the driver. At the moment, the only supported resources are devices with attributes and capacities. Each device in a given pool, regardless of how many ResourceSlices, must have a unique name. The ResourceSlice in which a device gets published may change over time. The unique identifier for a device is the tuple <driver name>, <pool name>, <device name>. Whenever a driver needs to update a pool, it increments the pool.Spec.Pool.Generation number and updates all ResourceSlices with that new number and new resource definitions. A consumer must only use ResourceSlices with the highest generation number and ignore all others. When allocating all resources in a pool matching certain criteria or when looking for the best solution among several different alternatives, a consumer should check the number of ResourceSlices in a pool (included in each ResourceSlice) to determine whether its view of a pool is complete and if not, should wait until the driver has completed updating the pool. For resources that are not local to a node, the node name is not set. Instead, the driver may use a node selector to specify where the devices are available. This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.
ResourceSliceSpec contains the information published by the driver in one ResourceSlice.
PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.
BasicSchedulingPolicy indicates that standard Kubernetes scheduling behavior should be used.
GangSchedulingPolicy defines the parameters for gang scheduling.
PodGroup represents a runtime instance of pods grouped together. PodGroups are created by workload controllers (Job, LWS, JobSet, etc...) from Workload.podGroupTemplates. PodGroup API enablement is toggled by the GenericWorkload feature gate.
PodGroupResourceClaim references exactly one ResourceClaim, either directly or by naming a ResourceClaimTemplate which is then turned into a ResourceClaim for the PodGroup.
PodGroupResourceClaimStatus is stored in the PodGroupStatus for each PodGroupResourceClaim which references a ResourceClaimTemplate. It stores the generated name for the corresponding ResourceClaim.
PodGroupSchedulingConstraints defines scheduling constraints (e.g. topology) for a PodGroup.
PodGroupSchedulingPolicy defines the scheduling configuration for a PodGroup. Exactly one policy must be set.
PodGroupSpec defines the desired state of a PodGroup.
PodGroupStatus represents information about the status of a pod group.
PodGroupTemplate represents a template for a set of pods with a scheduling policy.
PodGroupTemplateReference references a PodGroup template defined in some object (e.g. Workload). Exactly one reference must be set.
TopologyConstraint defines a topology constraint for a PodGroup.
TypedLocalObjectReference allows to reference typed object inside the same namespace.
Workload allows for expressing scheduling constraints that should be used when managing the lifecycle of workloads from the scheduling perspective, including scheduling, preemption, eviction and other phases. Workload API enablement is toggled by the GenericWorkload feature gate.
WorkloadPodGroupTemplateReference references the PodGroupTemplate within the Workload object.
WorkloadSpec defines the desired state of a Workload.
CSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.
CSIDriverSpec is the specification of a CSIDriver.
CSINode holds information about all CSI drivers installed on a node. CSI drivers do not need to create the CSINode object directly. As long as they use the node-driver-registrar sidecar container, the kubelet will automatically populate the CSINode object for the CSI driver as part of kubelet plugin registration. CSINode has the same name as a node. If the object is missing, it means either there are no CSI Drivers available on the node, or the Kubelet version is low enough that it doesn't create this object. CSINode has an OwnerReference that points to the corresponding node object.
CSINodeDriver holds information about the specification of one CSI driver installed on a node
CSINodeSpec holds information about the specification of all CSI drivers installed on a node
CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment. This can be used when considering where to instantiate new PersistentVolumes.
StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned. StorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.
TokenRequest contains parameters of a service account token.
VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node. VolumeAttachment objects are non-namespaced.
VolumeAttachmentSource represents a volume that should be attached. Right now only PersistenVolumes can be attached via external attacher, in future we may allow also inline volumes in pods. Exactly one member can be set.
VolumeAttachmentSpec is the specification of a VolumeAttachment request.
VolumeAttachmentStatus is the status of a VolumeAttachment request.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
VolumeError captures an error encountered during a volume operation.
VolumeNodeResources is a set of resource limits for scheduling of volumes.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
VolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver. The class can be specified during dynamic provisioning of PersistentVolumeClaims, and changed in the PersistentVolumeClaim spec after provisioning.
The names of the group, the version, and the resource.
Describes the state of a migration at a certain point.
StorageVersionMigration represents a migration of stored data to the latest storage version.
Spec of the storage version migration.
Status of the storage version migration.
StorageVersionMigration represents a migration of stored data to the latest storage version.
Spec of the storage version migration.
Status of the storage version migration.
CustomResourceColumnDefinition specifies a column for server side printing.
CustomResourceConversion describes how to convert different versions of a CR.
CustomResourceDefinition represents a resource that should be exposed on the API server. Its name MUST be in the format <.spec.name>.<.spec.group>.
CustomResourceDefinitionCondition contains details for the current condition of this pod.
CustomResourceDefinitionNames indicates the names to serve this CustomResourceDefinition
CustomResourceDefinitionSpec describes how a user wants their resource to appear
CustomResourceDefinitionStatus indicates the state of the CustomResourceDefinition
CustomResourceDefinitionVersion describes a version for CRD.
CustomResourceSubresourceScale defines how to serve the scale subresource for CustomResources.
Marker that enables the /status subresource for a CRD
CustomResourceSubresources defines the status and scale subresources for CustomResources.
CustomResourceValidation is a list of validation methods for CustomResources.
ExternalDocumentation allows referencing an external resource for extended documentation.
JSON represents any valid JSON value. These types are supported: bool, int64, float64, string, []interface{}, map[string]interface{} and nil.
JSONSchemaProps is a JSON-Schema following Specification Draft 4 (http://json-schema.org/).
JSONSchemaPropsOrArray represents a value that can either be a JSONSchemaProps or an array of JSONSchemaProps. Mainly here for serialization purposes.
JSONSchemaPropsOrBool represents JSONSchemaProps or a boolean value. Defaults to true for the boolean property.
JSONSchemaPropsOrStringArray represents a JSONSchemaProps or a string array.
SelectableField specifies the JSON path of a field that may be used with field selectors.
ServiceReference holds a reference to Service.legacy.k8s.io
ValidationRule describes a validation rule written in the CEL expression language.
WebhookClientConfig contains the information to make a TLS connection with the webhook.
WebhookConversion describes how to call a conversion webhook
APIGroup contains the name, the supported versions, and the preferred version of a group.
APIGroupList is a list of APIGroup, to allow clients to discover the API at /apis.
APIResource specifies the name of a resource and whether it is namespaced.
APIResourceList is a list of APIResource, it is used to expose the name of the resources supported in a specific group and version, and if the resource is namespaced.
APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.
Condition contains details for one aspect of the current state of this API Resource.
DeleteOptions may be provided when deleting an API object.
FieldSelectorRequirement is a selector that contains values, a key, and an operator that relates the key and values.
GroupResource specifies a Group and a Resource, but does not force a version. This is useful for identifying concepts during lookup stages without having partially valid types
GroupVersion contains the "group/version" and "version" string of a version. It is made a struct to keep extensibility.
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.
ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.
OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.
Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
ShardInfo describes the shard selector that was applied to produce a list response. Its presence on a list response indicates the list is a filtered subset.
Status is a return value for calls that don't return other objects.
StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.
StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.
Event represents a single event to a watched resource.
Info contains versioning information. how we'll want to distribute that information.
Dynamically generate IO::K8s classes from OpenAPI schema
cert-manager CRD resource map provider for IO::K8s
cert-manager X.509 certificate
cert-manager certificate signing request
cert-manager ACME challenge
cert-manager cluster-scoped certificate issuer
cert-manager namespace-scoped certificate issuer
cert-manager ACME order
Cilium CRD resource map provider for IO::K8s
Cilium BGP route advertisement
Cilium BGP cluster configuration
Cilium BGP per-node configuration
Cilium BGP per-node configuration override
Cilium BGP peer configuration
Cilium CIDR group for IP address management
Cilium cluster-wide Envoy proxy configuration
Cilium cluster-wide network policy
Cilium egress gateway policy
Cilium endpoint representing a pod's network state
Cilium Envoy proxy configuration
Cilium external workload identity
Cilium security identity
Cilium load balancer IP address pool
Cilium local redirect policy for traffic steering
Cilium network policy for namespace-scoped network security
Cilium node configuration and status
Cilium per-node configuration overrides
Cilium BGP route advertisement
Cilium BGP cluster configuration
Cilium BGP per-node configuration
Cilium BGP per-node configuration override
Cilium BGP peer configuration
Cilium BGP peering policy
Cilium CIDR group for IP address management
Cilium extensible datapath plugin registration
Cilium endpoint slice for scalable endpoint tracking
Cilium Gateway API class configuration
Cilium L2 announcement policy
Cilium pod IP address pool
Gateway API CRD resource map provider for IO::K8s
Gateway API TLS policy for connections to a backend
Gateway API gRPC routing rules
Gateway API network gateway
Gateway API controller class definition
Gateway API HTTP routing rules
Gateway API listeners defined independently of a Gateway
Gateway API cross-namespace reference permission (v1)
Gateway API raw TCP routing rules
Gateway API TLS SNI routing rules
Gateway API raw UDP routing rules
Gateway API cross-namespace reference permission
K3s CRD resource map provider for IO::K8s
K3s cluster addon
K3s etcd snapshot file
K3s Helm chart deployment
K3s Helm chart value overrides
APIService represents a server for a particular GroupVersion. Name must be "version.group".
APIServiceCondition describes the state of an APIService at a particular point
APIServiceSpec contains information for locating and communicating with a server. Only https is supported, though you are able to disable certificate verification.
APIServiceStatus contains derived information about an API server
ServiceReference holds a reference to Service.legacy.k8s.io
Generic list container for Kubernetes API responses
Internal collector for loading .pk8s manifest files
Base class for all Kubernetes resources
Role for top-level Kubernetes API objects
Role for cert-manager certificate and issuer management
Role for K3s Helm chart management
Role for traffic distribution (weighted backends, mirroring)
Role for building Traefik middleware configuration
Role for Kubernetes resources that live in a namespace
Role for building network policies (core K8s and Cilium)
Role providing Kubernetes resource instance behavior
Role for packages that provide a Kubernetes resource map
Role for building HTTP/gRPC routing rules
Role for deep-path spec manipulation on CRD objects
Traefik CRD resource map provider for IO::K8s
Traefik HTTP routing via IngressRoute
Traefik TCP routing via IngressRouteTCP
Traefik UDP routing via IngressRouteUDP
Traefik HTTP middleware
Traefik TCP middleware
Traefik servers transport configuration
Traefik TCP servers transport configuration
Traefik TLS configuration options
Traefik TLS certificate store
Traefik weighted round-robin and mirroring service
Type::Tiny type library for Kubernetes resources
Type::Tiny constraints for IP addresses and CIDR notation