mirror of
https://github.com/netbirdio/kubernetes-operator.git
synced 2026-05-22 17:11:40 -07:00
1165 lines
38 KiB
YAML
1165 lines
38 KiB
YAML
---
|
|
# Source: kubernetes-operator/crds/netbird.io_nbgroups.yaml
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: nbgroups.netbird.io
|
|
spec:
|
|
group: netbird.io
|
|
names:
|
|
kind: NBGroup
|
|
listKind: NBGroupList
|
|
plural: nbgroups
|
|
singular: nbgroup
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NBGroup is the Schema for the nbgroups API.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NBGroupSpec defines the desired state of NBGroup.
|
|
properties:
|
|
name:
|
|
minLength: 1
|
|
type: string
|
|
x-kubernetes-validations:
|
|
- message: Value is immutable
|
|
rule: self == oldSelf
|
|
required:
|
|
- name
|
|
type: object
|
|
status:
|
|
description: NBGroupStatus defines the observed state of NBGroup.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: NBCondition defines a condition in NBSetupKey status.
|
|
properties:
|
|
lastProbeTime:
|
|
description: Last time we probed the condition.
|
|
format: date-time
|
|
type: string
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status
|
|
to another.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Human-readable message indicating details about
|
|
last transition.
|
|
type: string
|
|
reason:
|
|
description: Unique, one-word, CamelCase reason for the condition's
|
|
last transition.
|
|
type: string
|
|
status:
|
|
description: |-
|
|
Status is the status of the condition.
|
|
Can be True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type is the type of the condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
groupID:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
|
|
---
|
|
# Source: kubernetes-operator/crds/netbird.io_nbpolicies.yaml
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: nbpolicies.netbird.io
|
|
spec:
|
|
group: netbird.io
|
|
names:
|
|
kind: NBPolicy
|
|
listKind: NBPolicyList
|
|
plural: nbpolicies
|
|
singular: nbpolicy
|
|
scope: Cluster
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NBPolicy is the Schema for the nbpolicies API.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NBPolicySpec defines the desired state of NBPolicy.
|
|
properties:
|
|
bidirectional:
|
|
default: true
|
|
type: boolean
|
|
description:
|
|
type: string
|
|
destinationGroups:
|
|
items:
|
|
minLength: 1
|
|
type: string
|
|
type: array
|
|
name:
|
|
description: Name Policy name
|
|
minLength: 1
|
|
type: string
|
|
ports:
|
|
items:
|
|
format: int32
|
|
maximum: 65535
|
|
minimum: 0
|
|
type: integer
|
|
type: array
|
|
protocols:
|
|
items:
|
|
enum:
|
|
- tcp
|
|
- udp
|
|
type: string
|
|
type: array
|
|
sourceGroups:
|
|
items:
|
|
minLength: 1
|
|
type: string
|
|
type: array
|
|
required:
|
|
- name
|
|
type: object
|
|
status:
|
|
description: NBPolicyStatus defines the observed state of NBPolicy.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: NBCondition defines a condition in NBSetupKey status.
|
|
properties:
|
|
lastProbeTime:
|
|
description: Last time we probed the condition.
|
|
format: date-time
|
|
type: string
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status
|
|
to another.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Human-readable message indicating details about
|
|
last transition.
|
|
type: string
|
|
reason:
|
|
description: Unique, one-word, CamelCase reason for the condition's
|
|
last transition.
|
|
type: string
|
|
status:
|
|
description: |-
|
|
Status is the status of the condition.
|
|
Can be True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type is the type of the condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
lastUpdatedAt:
|
|
format: date-time
|
|
type: string
|
|
managedServiceList:
|
|
items:
|
|
type: string
|
|
type: array
|
|
tcpPolicyID:
|
|
type: string
|
|
udpPolicyID:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
|
|
---
|
|
# Source: kubernetes-operator/crds/netbird.io_nbresources.yaml
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: nbresources.netbird.io
|
|
spec:
|
|
group: netbird.io
|
|
names:
|
|
kind: NBResource
|
|
listKind: NBResourceList
|
|
plural: nbresources
|
|
singular: nbresource
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NBResource is the Schema for the nbresources API.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NBResourceSpec defines the desired state of NBResource.
|
|
properties:
|
|
address:
|
|
minLength: 1
|
|
type: string
|
|
groups:
|
|
items:
|
|
minLength: 1
|
|
type: string
|
|
type: array
|
|
name:
|
|
minLength: 1
|
|
type: string
|
|
networkID:
|
|
type: string
|
|
x-kubernetes-validations:
|
|
- message: Value is immutable
|
|
rule: self == oldSelf
|
|
policyName:
|
|
type: string
|
|
tcpPorts:
|
|
items:
|
|
format: int32
|
|
type: integer
|
|
type: array
|
|
udpPorts:
|
|
items:
|
|
format: int32
|
|
type: integer
|
|
type: array
|
|
required:
|
|
- address
|
|
- groups
|
|
- name
|
|
- networkID
|
|
type: object
|
|
status:
|
|
description: NBResourceStatus defines the observed state of NBResource.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: NBCondition defines a condition in NBSetupKey status.
|
|
properties:
|
|
lastProbeTime:
|
|
description: Last time we probed the condition.
|
|
format: date-time
|
|
type: string
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status
|
|
to another.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Human-readable message indicating details about
|
|
last transition.
|
|
type: string
|
|
reason:
|
|
description: Unique, one-word, CamelCase reason for the condition's
|
|
last transition.
|
|
type: string
|
|
status:
|
|
description: |-
|
|
Status is the status of the condition.
|
|
Can be True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type is the type of the condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
groups:
|
|
items:
|
|
type: string
|
|
type: array
|
|
networkResourceID:
|
|
type: string
|
|
policyName:
|
|
type: string
|
|
tcpPorts:
|
|
items:
|
|
format: int32
|
|
type: integer
|
|
type: array
|
|
udpPorts:
|
|
items:
|
|
format: int32
|
|
type: integer
|
|
type: array
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
|
|
---
|
|
# Source: kubernetes-operator/crds/netbird.io_nbroutingpeers.yaml
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: nbroutingpeers.netbird.io
|
|
spec:
|
|
group: netbird.io
|
|
names:
|
|
kind: NBRoutingPeer
|
|
listKind: NBRoutingPeerList
|
|
plural: nbroutingpeers
|
|
singular: nbroutingpeer
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NBRoutingPeer is the Schema for the nbroutingpeers API.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NBRoutingPeerSpec defines the desired state of NBRoutingPeer.
|
|
properties:
|
|
annotations:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
labels:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
nodeSelector:
|
|
additionalProperties:
|
|
type: string
|
|
type: object
|
|
replicas:
|
|
format: int32
|
|
type: integer
|
|
resources:
|
|
description: ResourceRequirements describes the compute resource requirements.
|
|
properties:
|
|
claims:
|
|
description: |-
|
|
Claims lists the names of resources, defined in spec.resourceClaims,
|
|
that are used by this container.
|
|
|
|
This is an alpha field and requires enabling the
|
|
DynamicResourceAllocation feature gate.
|
|
|
|
This field is immutable. It can only be set for containers.
|
|
items:
|
|
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
|
|
properties:
|
|
name:
|
|
description: |-
|
|
Name must match the name of one entry in pod.spec.resourceClaims of
|
|
the Pod where this field is used. It makes that resource available
|
|
inside a container.
|
|
type: string
|
|
request:
|
|
description: |-
|
|
Request is the name chosen for a request in the referenced claim.
|
|
If empty, everything from the claim is made available, otherwise
|
|
only the result of this request.
|
|
type: string
|
|
required:
|
|
- name
|
|
type: object
|
|
type: array
|
|
x-kubernetes-list-map-keys:
|
|
- name
|
|
x-kubernetes-list-type: map
|
|
limits:
|
|
additionalProperties:
|
|
anyOf:
|
|
- type: integer
|
|
- type: string
|
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
|
x-kubernetes-int-or-string: true
|
|
description: |-
|
|
Limits describes the maximum amount of compute resources allowed.
|
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
type: object
|
|
requests:
|
|
additionalProperties:
|
|
anyOf:
|
|
- type: integer
|
|
- type: string
|
|
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
|
|
x-kubernetes-int-or-string: true
|
|
description: |-
|
|
Requests describes the minimum amount of compute resources required.
|
|
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
|
|
otherwise to an implementation-defined value. Requests cannot exceed Limits.
|
|
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
type: object
|
|
type: object
|
|
tolerations:
|
|
items:
|
|
description: |-
|
|
The pod this Toleration is attached to tolerates any taint that matches
|
|
the triple <key,value,effect> using the matching operator <operator>.
|
|
properties:
|
|
effect:
|
|
description: |-
|
|
Effect indicates the taint effect to match. Empty means match all taint effects.
|
|
When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
|
|
type: string
|
|
key:
|
|
description: |-
|
|
Key is the taint key that the toleration applies to. Empty means match all taint keys.
|
|
If the key is empty, operator must be Exists; this combination means to match all values and all keys.
|
|
type: string
|
|
operator:
|
|
description: |-
|
|
Operator represents a key's relationship to the value.
|
|
Valid operators are Exists and Equal. Defaults to Equal.
|
|
Exists is equivalent to wildcard for value, so that a pod can
|
|
tolerate all taints of a particular category.
|
|
type: string
|
|
tolerationSeconds:
|
|
description: |-
|
|
TolerationSeconds represents the period of time the toleration (which must be
|
|
of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
|
|
it is not set, which means tolerate the taint forever (do not evict). Zero and
|
|
negative values will be treated as 0 (evict immediately) by the system.
|
|
format: int64
|
|
type: integer
|
|
value:
|
|
description: |-
|
|
Value is the taint value the toleration matches to.
|
|
If the operator is Exists, the value should be empty, otherwise just a regular string.
|
|
type: string
|
|
type: object
|
|
type: array
|
|
type: object
|
|
status:
|
|
description: NBRoutingPeerStatus defines the observed state of NBRoutingPeer.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: NBCondition defines a condition in NBSetupKey status.
|
|
properties:
|
|
lastProbeTime:
|
|
description: Last time we probed the condition.
|
|
format: date-time
|
|
type: string
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status
|
|
to another.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Human-readable message indicating details about
|
|
last transition.
|
|
type: string
|
|
reason:
|
|
description: Unique, one-word, CamelCase reason for the condition's
|
|
last transition.
|
|
type: string
|
|
status:
|
|
description: |-
|
|
Status is the status of the condition.
|
|
Can be True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type is the type of the condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
networkID:
|
|
type: string
|
|
routerID:
|
|
type: string
|
|
setupKeyID:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
|
|
---
|
|
# Source: kubernetes-operator/crds/netbird.io_nbsetupkeys.yaml
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: nbsetupkeys.netbird.io
|
|
spec:
|
|
group: netbird.io
|
|
names:
|
|
kind: NBSetupKey
|
|
listKind: NBSetupKeyList
|
|
plural: nbsetupkeys
|
|
singular: nbsetupkey
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: NBSetupKey is the Schema for the nbsetupkeys API.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: NBSetupKeySpec defines the desired state of NBSetupKey.
|
|
properties:
|
|
managementURL:
|
|
description: ManagementURL optional, override operator management
|
|
URL
|
|
type: string
|
|
secretKeyRef:
|
|
description: SecretKeyRef is a reference to the secret containing
|
|
the setup key
|
|
properties:
|
|
key:
|
|
description: The key of the secret to select from. Must be a
|
|
valid secret key.
|
|
type: string
|
|
name:
|
|
default: ""
|
|
description: |-
|
|
Name of the referent.
|
|
This field is effectively required, but due to backwards compatibility is
|
|
allowed to be empty. Instances of this type with an empty value here are
|
|
almost certainly wrong.
|
|
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
|
type: string
|
|
optional:
|
|
description: Specify whether the Secret or its key must be defined
|
|
type: boolean
|
|
required:
|
|
- key
|
|
type: object
|
|
x-kubernetes-map-type: atomic
|
|
required:
|
|
- secretKeyRef
|
|
type: object
|
|
status:
|
|
description: NBSetupKeyStatus defines the observed state of NBSetupKey.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: NBCondition defines a condition in NBSetupKey status.
|
|
properties:
|
|
lastProbeTime:
|
|
description: Last time we probed the condition.
|
|
format: date-time
|
|
type: string
|
|
lastTransitionTime:
|
|
description: Last time the condition transitioned from one status
|
|
to another.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: Human-readable message indicating details about
|
|
last transition.
|
|
type: string
|
|
reason:
|
|
description: Unique, one-word, CamelCase reason for the condition's
|
|
last transition.
|
|
type: string
|
|
status:
|
|
description: |-
|
|
Status is the status of the condition.
|
|
Can be True, False, Unknown.
|
|
type: string
|
|
type:
|
|
description: Type is the type of the condition.
|
|
type: string
|
|
required:
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
|
|
---
|
|
# Source: kubernetes-operator/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
automountServiceAccountToken: true
|
|
---
|
|
# Source: kubernetes-operator/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
rules:
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbsetupkeys
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbsetupkeys/finalizers
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- netbird.io
|
|
resources:
|
|
- nbsetupkeys/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
# Source: kubernetes-operator/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kubernetes-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kubernetes-operator
|
|
namespace: production
|
|
---
|
|
# Source: kubernetes-operator/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
---
|
|
# Source: kubernetes-operator/templates/rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: kubernetes-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kubernetes-operator
|
|
namespace: production
|
|
---
|
|
# Source: kubernetes-operator/templates/service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kubernetes-operator-metrics
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
protocol: TCP
|
|
targetPort: 8080
|
|
selector:
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
---
|
|
# Source: kubernetes-operator/templates/service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kubernetes-operator-webhook-service
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: https
|
|
port: 443
|
|
protocol: TCP
|
|
targetPort: 9443
|
|
selector:
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
---
|
|
# Source: kubernetes-operator/templates/deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
serviceAccountName: kubernetes-operator
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: kubernetes-operator
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
image: "docker.io/netbirdio/kubernetes-operator:v0.1.0"
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /manager
|
|
args:
|
|
- --metrics-bind-address=:8080
|
|
- --leader-elect
|
|
- --health-probe-bind-address=:8081
|
|
- --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
|
|
ports:
|
|
- name: webhook-server
|
|
containerPort: 443
|
|
protocol: TCP
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
scheme: HTTP
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
scheme: HTTP
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
resources:
|
|
{}
|
|
volumeMounts:
|
|
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
|
name: webhook-certs
|
|
readOnly: true
|
|
volumes:
|
|
- name: webhook-certs
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: kubernetes-operator-tls
|
|
---
|
|
# Source: kubernetes-operator/templates/webhook.yaml
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: kubernetes-operator-serving-cert
|
|
namespace: production
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
dnsNames:
|
|
- kubernetes-operator-webhook-service.production.svc
|
|
- kubernetes-operator-webhook-service.production.svc.cluster.local
|
|
issuerRef:
|
|
kind: Issuer
|
|
name: kubernetes-operator-selfsigned-issuer
|
|
secretName: kubernetes-operator-tls
|
|
---
|
|
# Source: kubernetes-operator/templates/webhook.yaml
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: kubernetes-operator-selfsigned-issuer
|
|
namespace: production
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
# Source: kubernetes-operator/templates/webhook.yaml
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: production/kubernetes-operator-serving-cert
|
|
name: kubernetes-operator-mpod-webhook
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
webhooks:
|
|
- clientConfig:
|
|
service:
|
|
name: kubernetes-operator-webhook-service
|
|
namespace: production
|
|
path: /mutate--v1-pod
|
|
failurePolicy: Fail
|
|
name: mpod-v1.netbird.io
|
|
admissionReviewVersions:
|
|
- v1
|
|
objectSelector:
|
|
matchExpressions:
|
|
- key: app.kubernetes.io/name
|
|
operator: NotIn
|
|
values:
|
|
- kubernetes-operator
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- CREATE
|
|
resources:
|
|
- pods
|
|
sideEffects: None
|
|
---
|
|
# Source: kubernetes-operator/templates/webhook.yaml
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: production/kubernetes-operator-serving-cert
|
|
name: kubernetes-operator-vnbsetupkey-webhook
|
|
labels:
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
webhooks:
|
|
- clientConfig:
|
|
service:
|
|
name: kubernetes-operator-webhook-service
|
|
namespace: production
|
|
path: /validate-netbird-io-v1-nbsetupkey
|
|
failurePolicy: Fail
|
|
name: vnbsetupkey-v1.netbird.io
|
|
admissionReviewVersions:
|
|
- v1
|
|
rules:
|
|
- apiGroups:
|
|
- netbird.io
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- CREATE
|
|
- UPDATE
|
|
resources:
|
|
- "nbsetupkeys"
|
|
sideEffects: None
|
|
---
|
|
# Source: kubernetes-operator/templates/pre-delete.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: kubernetes-operator-delete-routers
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
annotations:
|
|
helm.sh/hook: pre-delete
|
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
|
spec:
|
|
backOffLimit: 3
|
|
template:
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
containers:
|
|
- name: pre-delete
|
|
image: "bitnami/kubectl:latest"
|
|
args:
|
|
- delete
|
|
- --all
|
|
- -A
|
|
- --cascade=foreground
|
|
- --ignore-not-found
|
|
- NBRoutingPeer
|
|
serviceAccountName: kubernetes-operator
|
|
restartPolicy: Never
|
|
---
|
|
# Source: kubernetes-operator/templates/pre-delete.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: kubernetes-operator-delete-policies
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
annotations:
|
|
helm.sh/hook: pre-delete
|
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
|
spec:
|
|
backOffLimit: 3
|
|
template:
|
|
metadata:
|
|
name: kubernetes-operator
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
helm.sh/chart: kubernetes-operator-0.1.1
|
|
app.kubernetes.io/name: kubernetes-operator
|
|
app.kubernetes.io/instance: kubernetes-operator
|
|
app.kubernetes.io/version: "v0.1.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
containers:
|
|
- name: pre-delete
|
|
image: "bitnami/kubectl:latest"
|
|
args:
|
|
- delete
|
|
- --all
|
|
- --cascade=foreground
|
|
- --ignore-not-found
|
|
- NBPolicy
|
|
serviceAccountName: kubernetes-operator
|
|
restartPolicy: Never
|