| Name | +Type | +Description | +Required | +
|---|---|---|---|
| volumeID | +string | +
+ volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).
+More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type of the volume that you want to mount.
+Tip: Ensure that the filesystem type is supported by the host operating system.
+Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + |
+ false | +
| partition | +integer | +
+ partition is the partition in the volume that you want to mount.
+If omitted, the default is to mount by volume name.
+Examples: For volume /dev/sda1, you specify the partition as "1".
+Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + + Format: int32 + |
+ false | +
| readOnly | +boolean | +
+ readOnly value true will force the readOnly setting in VolumeMounts.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| diskName | +string | +
+ diskName is the Name of the data disk in the blob storage + |
+ true | +
| diskURI | +string | +
+ diskURI is the URI of data disk in the blob storage + |
+ true | +
| cachingMode | +string | +
+ cachingMode is the Host Caching mode: None, Read Only, Read Write. + |
+ false | +
| fsType | +string | +
+ fsType is Filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + + Default: ext4 + |
+ false | +
| kind | +string | +
+ kind expected values are Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared + |
+ false | +
| readOnly | +boolean | +
+ readOnly Defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + + Default: false + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| secretName | +string | +
+ secretName is the name of secret that contains Azure Storage Account Name and Key + |
+ true | +
| shareName | +string | +
+ shareName is the azure share Name + |
+ true | +
| readOnly | +boolean | +
+ readOnly defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| monitors | +[]string | +
+ monitors is Required: Monitors is a collection of Ceph monitors
+More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + |
+ true | +
| path | +string | +
+ path is Optional: Used as the mounted root, rather than the full Ceph tree, default is / + |
+ false | +
| readOnly | +boolean | +
+ readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts.
+More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + |
+ false | +
| secretFile | +string | +
+ secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret
+More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + |
+ false | +
| secretRef | +object | +
+ secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.
+More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + |
+ false | +
| user | +string | +
+ user is optional: User is the rados user name, default is admin
+More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| volumeID | +string | +
+ volumeID used to identify the volume in cinder.
+More info: https://examples.k8s.io/mysql-cinder-pd/README.md + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+More info: https://examples.k8s.io/mysql-cinder-pd/README.md + |
+ false | +
| readOnly | +boolean | +
+ readOnly defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts.
+More info: https://examples.k8s.io/mysql-cinder-pd/README.md + |
+ false | +
| secretRef | +object | +
+ secretRef is optional: points to a secret object containing parameters used to connect
+to OpenStack. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| defaultMode | +integer | +
+ defaultMode is optional: mode bits used to set permissions on created files by default.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+Defaults to 0644.
+Directories within the path are not affected by this setting.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| items | +[]object | +
+ items if unspecified, each key-value pair in the Data field of the referenced
+ConfigMap will be projected into the volume as a file whose name is the
+key and content is the value. If specified, the listed keys will be
+projected into the specified paths, and unlisted keys will not be
+present. If a key is specified which is not present in the ConfigMap,
+the volume setup will error unless it is marked optional. Paths must be
+relative and may not contain the '..' path or start with '..'. + |
+ false | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ optional specify whether the ConfigMap or its keys must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the key to project. + |
+ true | +
| path | +string | +
+ path is the relative path of the file to map the key to.
+May not be an absolute path.
+May not contain the path element '..'.
+May not start with the string '..'. + |
+ true | +
| mode | +integer | +
+ mode is Optional: mode bits used to set permissions on this file.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| driver | +string | +
+ driver is the name of the CSI driver that handles this volume.
+Consult with your admin for the correct name as registered in the cluster. + |
+ true | +
| fsType | +string | +
+ fsType to mount. Ex. "ext4", "xfs", "ntfs".
+If not provided, the empty value is passed to the associated CSI driver
+which will determine the default filesystem to apply. + |
+ false | +
| nodePublishSecretRef | +object | +
+ nodePublishSecretRef is a reference to the secret object containing
+sensitive information to pass to the CSI driver to complete the CSI
+NodePublishVolume and NodeUnpublishVolume calls.
+This field is optional, and may be empty if no secret is required. If the
+secret object contains more than one secret, all secret references are passed. + |
+ false | +
| readOnly | +boolean | +
+ readOnly specifies a read-only configuration for the volume.
+Defaults to false (read/write). + |
+ false | +
| volumeAttributes | +map[string]string | +
+ volumeAttributes stores driver-specific properties that are passed to the CSI
+driver. Consult your driver's documentation for supported values. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| defaultMode | +integer | +
+ Optional: mode bits to use on created files by default. Must be a
+Optional: mode bits used to set permissions on created files by default.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+Defaults to 0644.
+Directories within the path are not affected by this setting.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| items | +[]object | +
+ Items is a list of downward API volume file + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..' + |
+ true | +
| fieldRef | +object | +
+ Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported. + |
+ false | +
| mode | +integer | +
+ Optional: mode bits used to set permissions on this file, must be an octal value
+between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| resourceFieldRef | +object | +
+ Selects a resource of the container: only resources limits and requests
+(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fieldPath | +string | +
+ Path of the field to select in the specified API version. + |
+ true | +
| apiVersion | +string | +
+ Version of the schema the FieldPath is written in terms of, defaults to "v1". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resource | +string | +
+ Required: resource to select + |
+ true | +
| containerName | +string | +
+ Container name: required for volumes, optional for env vars + |
+ false | +
| divisor | +int or string | +
+ Specifies the output format of the exposed resources, defaults to "1" + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| medium | +string | +
+ medium represents what type of storage medium should back this directory.
+The default is "" which means to use the node's default medium.
+Must be an empty string (default) or Memory.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + |
+ false | +
| sizeLimit | +int or string | +
+ sizeLimit is the total amount of local storage required for this EmptyDir volume.
+The size limit is also applicable for memory medium.
+The maximum usage on memory medium EmptyDir would be the minimum value between
+the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+The default is nil which means that the limit is undefined.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| volumeClaimTemplate | +object | +
+ Will be used to create a stand-alone PVC to provision the volume.
+The pod in which this EphemeralVolumeSource is embedded will be the
+owner of the PVC, i.e. the PVC will be deleted together with the
+pod. The name of the PVC will be ` + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| spec | +object | +
+ The specification for the PersistentVolumeClaim. The entire content is
+copied unchanged into the PVC that gets created from this
+template. The same fields as in a PersistentVolumeClaim
+are also valid here. + |
+ true | +
| metadata | +object | +
+ May contain labels and annotations that will be copied into the PVC
+when creating it. No other fields are allowed and will be rejected during
+validation. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| accessModes | +[]string | +
+ accessModes contains the desired access modes the volume should have.
+More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + |
+ false | +
| dataSource | +object | +
+ dataSource field can be used to specify either:
+* An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
+* An existing PVC (PersistentVolumeClaim)
+If the provisioner or an external controller can support the specified data source,
+it will create a new volume based on the contents of the specified data source.
+When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
+and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+If the namespace is specified, then dataSourceRef will not be copied to dataSource. + |
+ false | +
| dataSourceRef | +object | +
+ dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
+volume is desired. This may be any object from a non-empty API group (non
+core object) or a PersistentVolumeClaim object.
+When this field is specified, volume binding will only succeed if the type of
+the specified object matches some installed volume populator or dynamic
+provisioner.
+This field will replace the functionality of the dataSource field and as such
+if both fields are non-empty, they must have the same value. For backwards
+compatibility, when namespace isn't specified in dataSourceRef,
+both fields (dataSource and dataSourceRef) will be set to the same
+value automatically if one of them is empty and the other is non-empty.
+When namespace is specified in dataSourceRef,
+dataSource isn't set to the same value and must be empty.
+There are three important differences between dataSource and dataSourceRef:
+* While dataSource only allows two specific types of objects, dataSourceRef
+ allows any non-core object, as well as PersistentVolumeClaim objects. + |
+ false | +
| resources | +object | +
+ resources represents the minimum resources the volume should have.
+If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+that are lower than previous value but must still be higher than capacity recorded in the
+status field of the claim.
+More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + |
+ false | +
| selector | +object | +
+ selector is a label query over volumes to consider for binding. + |
+ false | +
| storageClassName | +string | +
+ storageClassName is the name of the StorageClass required by the claim.
+More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + |
+ false | +
| volumeAttributesClassName | +string | +
+ volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
+If specified, the CSI driver will create or update the volume with the attributes defined
+in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
+it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass
+will be applied to the claim but it's not allowed to reset this field to empty string once it is set.
+If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass
+will be set by the persistentvolume controller if it exists.
+If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
+set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
+exists.
+More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+(Beta) Using this field requires the VolumeAttributesClass feature gate to be enabled (off by default). + |
+ false | +
| volumeMode | +string | +
+ volumeMode defines what type of volume is required by the claim.
+Value of Filesystem is implied when not included in claim spec. + |
+ false | +
| volumeName | +string | +
+ volumeName is the binding reference to the PersistentVolume backing this claim. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| kind | +string | +
+ Kind is the type of resource being referenced + |
+ true | +
| name | +string | +
+ Name is the name of resource being referenced + |
+ true | +
| apiGroup | +string | +
+ APIGroup is the group for the resource being referenced.
+If APIGroup is not specified, the specified Kind must be in the core API group.
+For any other third-party types, APIGroup is required. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| kind | +string | +
+ Kind is the type of resource being referenced + |
+ true | +
| name | +string | +
+ Name is the name of resource being referenced + |
+ true | +
| apiGroup | +string | +
+ APIGroup is the group for the resource being referenced.
+If APIGroup is not specified, the specified Kind must be in the core API group.
+For any other third-party types, APIGroup is required. + |
+ false | +
| namespace | +string | +
+ Namespace is the namespace of resource being referenced
+Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
+(Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| limits | +map[string]int or string | +
+ Limits describes the maximum amount of compute resources allowed.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| requests | +map[string]int or string | +
+ Requests describes the minimum amount of compute resources required.
+If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+otherwise to an implementation-defined value. Requests cannot exceed Limits.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| annotations | +map[string]string | +
+ + |
+ false | +
| finalizers | +[]string | +
+ + |
+ false | +
| labels | +map[string]string | +
+ + |
+ false | +
| name | +string | +
+ + |
+ false | +
| namespace | +string | +
+ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + |
+ false | +
| lun | +integer | +
+ lun is Optional: FC target lun number + + Format: int32 + |
+ false | +
| readOnly | +boolean | +
+ readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| targetWWNs | +[]string | +
+ targetWWNs is Optional: FC target worldwide names (WWNs) + |
+ false | +
| wwids | +[]string | +
+ wwids Optional: FC volume world wide identifiers (wwids)
+Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| driver | +string | +
+ driver is the name of the driver to use for this volume. + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + |
+ false | +
| options | +map[string]string | +
+ options is Optional: this field holds extra command options if any. + |
+ false | +
| readOnly | +boolean | +
+ readOnly is Optional: defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| secretRef | +object | +
+ secretRef is Optional: secretRef is reference to the secret object containing
+sensitive information to pass to the plugin scripts. This may be
+empty if no secret object is specified. If the secret object
+contains more than one secret, all secrets are passed to the plugin
+scripts. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| datasetName | +string | +
+ datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker
+should be considered as deprecated + |
+ false | +
| datasetUUID | +string | +
+ datasetUUID is the UUID of the dataset. This is unique identifier of a Flocker dataset + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| pdName | +string | +
+ pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + |
+ true | +
| fsType | +string | +
+ fsType is filesystem type of the volume that you want to mount.
+Tip: Ensure that the filesystem type is supported by the host operating system.
+Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + |
+ false | +
| partition | +integer | +
+ partition is the partition in the volume that you want to mount.
+If omitted, the default is to mount by volume name.
+Examples: For volume /dev/sda1, you specify the partition as "1".
+Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + + Format: int32 + |
+ false | +
| readOnly | +boolean | +
+ readOnly here will force the ReadOnly setting in VolumeMounts.
+Defaults to false.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| repository | +string | +
+ repository is the URL + |
+ true | +
| directory | +string | +
+ directory is the target directory name.
+Must not contain or start with '..'. If '.' is supplied, the volume directory will be the
+git repository. Otherwise, if specified, the volume will contain the git repository in
+the subdirectory with the given name. + |
+ false | +
| revision | +string | +
+ revision is the commit hash for the specified revision. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| endpoints | +string | +
+ endpoints is the endpoint name that details Glusterfs topology.
+More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + |
+ true | +
| path | +string | +
+ path is the Glusterfs volume path.
+More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + |
+ true | +
| readOnly | +boolean | +
+ readOnly here will force the Glusterfs volume to be mounted with read-only permissions.
+Defaults to false.
+More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ path of the directory on the host.
+If the path is a symlink, it will follow the link to the real path.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + |
+ true | +
| type | +string | +
+ type for HostPath Volume
+Defaults to ""
+More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| pullPolicy | +string | +
+ Policy for pulling OCI objects. Possible values are:
+Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + |
+ false | +
| reference | +string | +
+ Required: Image or artifact reference to be used.
+Behaves in the same way as pod.spec.containers[*].image.
+Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
+More info: https://kubernetes.io/docs/concepts/containers/images
+This field is optional to allow higher level config management to default or override
+container images in workload controllers like Deployments and StatefulSets. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| iqn | +string | +
+ iqn is the target iSCSI Qualified Name. + |
+ true | +
| lun | +integer | +
+ lun represents iSCSI Target Lun number. + + Format: int32 + |
+ true | +
| targetPortal | +string | +
+ targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
+is other than default (typically TCP ports 860 and 3260). + |
+ true | +
| chapAuthDiscovery | +boolean | +
+ chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication + |
+ false | +
| chapAuthSession | +boolean | +
+ chapAuthSession defines whether support iSCSI Session CHAP authentication + |
+ false | +
| fsType | +string | +
+ fsType is the filesystem type of the volume that you want to mount.
+Tip: Ensure that the filesystem type is supported by the host operating system.
+Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + |
+ false | +
| initiatorName | +string | +
+ initiatorName is the custom iSCSI Initiator Name.
+If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
+ + |
+ false | +
| iscsiInterface | +string | +
+ iscsiInterface is the interface Name that uses an iSCSI transport.
+Defaults to 'default' (tcp). + + Default: default + |
+ false | +
| portals | +[]string | +
+ portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
+is other than default (typically TCP ports 860 and 3260). + |
+ false | +
| readOnly | +boolean | +
+ readOnly here will force the ReadOnly setting in VolumeMounts.
+Defaults to false. + |
+ false | +
| secretRef | +object | +
+ secretRef is the CHAP Secret for iSCSI target and initiator authentication + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ path that is exported by the NFS server.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + |
+ true | +
| server | +string | +
+ server is the hostname or IP address of the NFS server.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + |
+ true | +
| readOnly | +boolean | +
+ readOnly here will force the NFS export to be mounted with read-only permissions.
+Defaults to false.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| claimName | +string | +
+ claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
+More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + |
+ true | +
| readOnly | +boolean | +
+ readOnly Will force the ReadOnly setting in VolumeMounts.
+Default false. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| pdID | +string | +
+ pdID is the ID that identifies Photon Controller persistent disk + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| volumeID | +string | +
+ volumeID uniquely identifies a Portworx volume + |
+ true | +
| fsType | +string | +
+ fSType represents the filesystem type to mount
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + |
+ false | +
| readOnly | +boolean | +
+ readOnly defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| defaultMode | +integer | +
+ defaultMode are the mode bits used to set permissions on created files by default.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+Directories within the path are not affected by this setting.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| sources | +[]object | +
+ sources is the list of volume projections. Each entry in this list
+handles one source. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| clusterTrustBundle | +object | +
+ ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+of ClusterTrustBundle objects in an auto-updating file.
+
+Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+ClusterTrustBundle objects can either be selected by name, or by the
+combination of signer name and a label selector.
+
+Kubelet performs aggressive normalization of the PEM contents written
+into the pod filesystem. Esoteric PEM features such as inter-block
+comments and block headers are stripped. Certificates are deduplicated.
+The ordering of certificates within the file is arbitrary, and Kubelet
+may change the order over time. + |
+ false | +
| configMap | +object | +
+ configMap information about the configMap data to project + |
+ false | +
| downwardAPI | +object | +
+ downwardAPI information about the downwardAPI data to project + |
+ false | +
| secret | +object | +
+ secret information about the secret data to project + |
+ false | +
| serviceAccountToken | +object | +
+ serviceAccountToken is information about the serviceAccountToken data to project + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ Relative path from the volume root to write the bundle. + |
+ true | +
| labelSelector | +object | +
+ Select all ClusterTrustBundles that match this label selector. Only has
+effect if signerName is set. Mutually-exclusive with name. If unset,
+interpreted as "match nothing". If set but empty, interpreted as "match
+everything". + |
+ false | +
| name | +string | +
+ Select a single ClusterTrustBundle by object name. Mutually-exclusive
+with signerName and labelSelector. + |
+ false | +
| optional | +boolean | +
+ If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+aren't available. If using name, then the named ClusterTrustBundle is
+allowed not to exist. If using signerName, then the combination of
+signerName and labelSelector is allowed to match zero
+ClusterTrustBundles. + |
+ false | +
| signerName | +string | +
+ Select all ClusterTrustBundles that match this signer name.
+Mutually-exclusive with name. The contents of all selected
+ClusterTrustBundles will be unified and deduplicated. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| items | +[]object | +
+ items if unspecified, each key-value pair in the Data field of the referenced
+ConfigMap will be projected into the volume as a file whose name is the
+key and content is the value. If specified, the listed keys will be
+projected into the specified paths, and unlisted keys will not be
+present. If a key is specified which is not present in the ConfigMap,
+the volume setup will error unless it is marked optional. Paths must be
+relative and may not contain the '..' path or start with '..'. + |
+ false | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ optional specify whether the ConfigMap or its keys must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the key to project. + |
+ true | +
| path | +string | +
+ path is the relative path of the file to map the key to.
+May not be an absolute path.
+May not contain the path element '..'.
+May not start with the string '..'. + |
+ true | +
| mode | +integer | +
+ mode is Optional: mode bits used to set permissions on this file.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| items | +[]object | +
+ Items is a list of DownwardAPIVolume file + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..' + |
+ true | +
| fieldRef | +object | +
+ Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported. + |
+ false | +
| mode | +integer | +
+ Optional: mode bits used to set permissions on this file, must be an octal value
+between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| resourceFieldRef | +object | +
+ Selects a resource of the container: only resources limits and requests
+(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fieldPath | +string | +
+ Path of the field to select in the specified API version. + |
+ true | +
| apiVersion | +string | +
+ Version of the schema the FieldPath is written in terms of, defaults to "v1". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resource | +string | +
+ Required: resource to select + |
+ true | +
| containerName | +string | +
+ Container name: required for volumes, optional for env vars + |
+ false | +
| divisor | +int or string | +
+ Specifies the output format of the exposed resources, defaults to "1" + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| items | +[]object | +
+ items if unspecified, each key-value pair in the Data field of the referenced
+Secret will be projected into the volume as a file whose name is the
+key and content is the value. If specified, the listed keys will be
+projected into the specified paths, and unlisted keys will not be
+present. If a key is specified which is not present in the Secret,
+the volume setup will error unless it is marked optional. Paths must be
+relative and may not contain the '..' path or start with '..'. + |
+ false | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ optional field specify whether the Secret or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the key to project. + |
+ true | +
| path | +string | +
+ path is the relative path of the file to map the key to.
+May not be an absolute path.
+May not contain the path element '..'.
+May not start with the string '..'. + |
+ true | +
| mode | +integer | +
+ mode is Optional: mode bits used to set permissions on this file.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| path | +string | +
+ path is the path relative to the mount point of the file to project the
+token into. + |
+ true | +
| audience | +string | +
+ audience is the intended audience of the token. A recipient of a token
+must identify itself with an identifier specified in the audience of the
+token, and otherwise should reject the token. The audience defaults to the
+identifier of the apiserver. + |
+ false | +
| expirationSeconds | +integer | +
+ expirationSeconds is the requested duration of validity of the service
+account token. As the token approaches expiration, the kubelet volume
+plugin will proactively rotate the service account token. The kubelet will
+start trying to rotate the token if the token is older than 80 percent of
+its time to live or if the token is older than 24 hours.Defaults to 1 hour
+and must be at least 10 minutes. + + Format: int64 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| registry | +string | +
+ registry represents a single or multiple Quobyte Registry services
+specified as a string as host:port pair (multiple entries are separated with commas)
+which acts as the central registry for volumes + |
+ true | +
| volume | +string | +
+ volume is a string that references an already created Quobyte volume by name. + |
+ true | +
| group | +string | +
+ group to map volume access to
+Default is no group + |
+ false | +
| readOnly | +boolean | +
+ readOnly here will force the Quobyte volume to be mounted with read-only permissions.
+Defaults to false. + |
+ false | +
| tenant | +string | +
+ tenant owning the given Quobyte volume in the Backend
+Used with dynamically provisioned Quobyte volumes, value is set by the plugin + |
+ false | +
| user | +string | +
+ user to map volume access to
+Defaults to serivceaccount user + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| image | +string | +
+ image is the rados image name.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + |
+ true | +
| monitors | +[]string | +
+ monitors is a collection of Ceph monitors.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type of the volume that you want to mount.
+Tip: Ensure that the filesystem type is supported by the host operating system.
+Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + |
+ false | +
| keyring | +string | +
+ keyring is the path to key ring for RBDUser.
+Default is /etc/ceph/keyring.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + + Default: /etc/ceph/keyring + |
+ false | +
| pool | +string | +
+ pool is the rados pool name.
+Default is rbd.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + + Default: rbd + |
+ false | +
| readOnly | +boolean | +
+ readOnly here will force the ReadOnly setting in VolumeMounts.
+Defaults to false.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + |
+ false | +
| secretRef | +object | +
+ secretRef is name of the authentication secret for RBDUser. If provided
+overrides keyring.
+Default is nil.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + |
+ false | +
| user | +string | +
+ user is the rados user name.
+Default is admin.
+More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + + Default: admin + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| gateway | +string | +
+ gateway is the host address of the ScaleIO API Gateway. + |
+ true | +
| secretRef | +object | +
+ secretRef references to the secret for ScaleIO user and other
+sensitive information. If this is not provided, Login operation will fail. + |
+ true | +
| system | +string | +
+ system is the name of the storage system as configured in ScaleIO. + |
+ true | +
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs".
+Default is "xfs". + + Default: xfs + |
+ false | +
| protectionDomain | +string | +
+ protectionDomain is the name of the ScaleIO Protection Domain for the configured storage. + |
+ false | +
| readOnly | +boolean | +
+ readOnly Defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| sslEnabled | +boolean | +
+ sslEnabled Flag enable/disable SSL communication with Gateway, default false + |
+ false | +
| storageMode | +string | +
+ storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+Default is ThinProvisioned. + + Default: ThinProvisioned + |
+ false | +
| storagePool | +string | +
+ storagePool is the ScaleIO Storage Pool associated with the protection domain. + |
+ false | +
| volumeName | +string | +
+ volumeName is the name of a volume already created in the ScaleIO system
+that is associated with this volume source. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| defaultMode | +integer | +
+ defaultMode is Optional: mode bits used to set permissions on created files by default.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values
+for mode bits. Defaults to 0644.
+Directories within the path are not affected by this setting.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| items | +[]object | +
+ items If unspecified, each key-value pair in the Data field of the referenced
+Secret will be projected into the volume as a file whose name is the
+key and content is the value. If specified, the listed keys will be
+projected into the specified paths, and unlisted keys will not be
+present. If a key is specified which is not present in the Secret,
+the volume setup will error unless it is marked optional. Paths must be
+relative and may not contain the '..' path or start with '..'. + |
+ false | +
| optional | +boolean | +
+ optional field specify whether the Secret or its keys must be defined + |
+ false | +
| secretName | +string | +
+ secretName is the name of the secret in the pod's namespace to use.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the key to project. + |
+ true | +
| path | +string | +
+ path is the relative path of the file to map the key to.
+May not be an absolute path.
+May not contain the path element '..'.
+May not start with the string '..'. + |
+ true | +
| mode | +integer | +
+ mode is Optional: mode bits used to set permissions on this file.
+Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+If not specified, the volume defaultMode will be used.
+This might be in conflict with other options that affect the file
+mode, like fsGroup, and the result can be other mode bits set. + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fsType | +string | +
+ fsType is the filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + |
+ false | +
| readOnly | +boolean | +
+ readOnly defaults to false (read/write). ReadOnly here will force
+the ReadOnly setting in VolumeMounts. + |
+ false | +
| secretRef | +object | +
+ secretRef specifies the secret to use for obtaining the StorageOS API
+credentials. If not specified, default values will be attempted. + |
+ false | +
| volumeName | +string | +
+ volumeName is the human-readable name of the StorageOS volume. Volume
+names are only unique within a namespace. + |
+ false | +
| volumeNamespace | +string | +
+ volumeNamespace specifies the scope of the volume within StorageOS. If no
+namespace is specified then the Pod's namespace will be used. This allows the
+Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
+Set VolumeName to any name to override the default behaviour.
+Set to "default" if you are not using namespaces within StorageOS.
+Namespaces that do not pre-exist within StorageOS will be created. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| volumePath | +string | +
+ volumePath is the path that identifies vSphere volume vmdk + |
+ true | +
| fsType | +string | +
+ fsType is filesystem type to mount.
+Must be a filesystem type supported by the host operating system.
+Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + |
+ false | +
| storagePolicyID | +string | +
+ storagePolicyID is the storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName. + |
+ false | +
| storagePolicyName | +string | +
+ storagePolicyName is the storage Policy Based Management (SPBM) profile name. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| image | +string | +
+ Image indicates the container image to use for the OpenTelemetry Collector. + |
+ false | +
| messages | +[]string | +
+ Messages about actions performed by the operator on this resource.
+Deprecated: use Kubernetes events instead. + |
+ false | +
| replicas | +integer | +
+ Replicas is currently not being set and might be removed in the next version.
+Deprecated: use "OpenTelemetryCollector.Status.Scale.Replicas" instead. + + Format: int32 + |
+ false | +
| scale | +object | +
+ Scale is the OpenTelemetryCollector's scale subresource status. + |
+ false | +
| version | +string | +
+ Version of the managed OpenTelemetry Collector (operand) + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| replicas | +integer | +
+ The total number non-terminated pods targeted by this
+OpenTelemetryCollector's deployment or statefulSet. + + Format: int32 + |
+ false | +
| selector | +string | +
+ The selector used to match the OpenTelemetryCollector's
+deployment or statefulSet pods. + |
+ false | +
| statusReplicas | +string | +
+ StatusReplicas is the number of pods targeted by this OpenTelemetryCollector's with a Ready Condition /
+Total number of non-terminated pods targeted by this OpenTelemetryCollector's (their labels match the selector).
+Deployment, Daemonset, StatefulSet. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| apiVersion | +string | +opentelemetry.io/v1alpha1 | +true | +
| kind | +string | +TargetAllocator | +true | +
| metadata | +object | +Refer to the Kubernetes API documentation for the fields of the `metadata` field. | +true | +
| spec | +object | +
+ TargetAllocatorSpec defines the desired state of TargetAllocator. + |
+ false | +
| status | +object | +
+ TargetAllocatorStatus defines the observed state of Target Allocator. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| managementState | +enum | +
+ ManagementState defines if the CR should be managed by the operator or not.
+Default is managed. + + Enum: managed, unmanaged + Default: managed + |
+ true | +
| additionalContainers | +[]object | +
+ AdditionalContainers allows injecting additional containers into the generated pod definition.
+These sidecar containers can be used for authentication proxies, log shipping sidecars, agents for shipping
+metrics to their cloud, or in general sidecars that do not support automatic injection.
+This only works with the following OpenTelemetryCollector mode's: daemonset, statefulset, and deployment.
+
+Container names managed by the operator:
+* `otc-container`
+
+Overriding containers managed by the operator is outside the scope of what the maintainers will support and by
+doing so, you wil accept the risk of it breaking things. + |
+ false | +
| affinity | +object | +
+ If specified, indicates the pod's scheduling constraints + |
+ false | +
| allocationStrategy | +enum | +
+ AllocationStrategy determines which strategy the target allocator should use for allocation.
+The current options are least-weighted, consistent-hashing and per-node. The default is
+consistent-hashing.
+WARNING: The per-node strategy currently ignores targets without a Node, like control plane components. + + Enum: least-weighted, consistent-hashing, per-node + Default: consistent-hashing + |
+ false | +
| args | +map[string]string | +
+ Args is the set of arguments to pass to the main container's binary. + |
+ false | +
| env | +[]object | +
+ Environment variables to set on the generated pods. + |
+ false | +
| envFrom | +[]object | +
+ List of sources to populate environment variables on the generated pods. + |
+ false | +
| filterStrategy | +enum | +
+ FilterStrategy determines how to filter targets before allocating them among the collectors.
+The only current option is relabel-config (drops targets based on prom relabel_config).
+The default is relabel-config. + + Enum: , relabel-config + Default: relabel-config + |
+ false | +
| global | +object | +
+ GlobalConfig configures the global configuration for Prometheus
+For more info, see https://prometheus.io/docs/prometheus/latest/configuration/configuration/#configuration-file. + |
+ false | +
| hostNetwork | +boolean | +
+ HostNetwork indicates if the pod should run in the host networking namespace. + |
+ false | +
| image | +string | +
+ Image indicates the container image to use for the generated pods. + |
+ false | +
| imagePullPolicy | +string | +
+ ImagePullPolicy indicates the pull policy to be used for retrieving the container image. + |
+ false | +
| initContainers | +[]object | +
+ InitContainers allows injecting initContainers to the generated pod definition.
+These init containers can be used to fetch secrets for injection into the
+configuration from external sources, run added checks, etc. Any errors during the execution of
+an initContainer will lead to a restart of the Pod. More info:
+https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + |
+ false | +
| ipFamilies | +[]string | +
+ IPFamily represents the IP Family (IPv4 or IPv6). This type is used
+to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + |
+ false | +
| ipFamilyPolicy | +string | +
+ IPFamilyPolicy represents the dual-stack-ness requested or required by a Service + + Default: SingleStack + |
+ false | +
| lifecycle | +object | +
+ Actions that the management system should take in response to container lifecycle events. Cannot be updated. + |
+ false | +
| nodeSelector | +map[string]string | +
+ NodeSelector to schedule generated pods.
+This only works with the following OpenTelemetryCollector mode's: daemonset, statefulset, and deployment. + |
+ false | +
| observability | +object | +
+ ObservabilitySpec defines how telemetry data gets handled. + |
+ false | +
| podAnnotations | +map[string]string | +
+ PodAnnotations is the set of annotations that will be attached to
+the generated pods. + |
+ false | +
| podDisruptionBudget | +object | +
+ PodDisruptionBudget specifies the pod disruption budget configuration to use
+for the generated workload. By default, a PDB with a MaxUnavailable of one is set. + |
+ false | +
| podDnsConfig | +object | +
+ PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy. + |
+ false | +
| podSecurityContext | +object | +
+ PodSecurityContext configures the pod security context for the
+generated pod, when running as a deployment, daemonset,
+or statefulset.
+
+In sidecar mode, the opentelemetry-operator will ignore this setting. + |
+ false | +
| ports | +[]object | +
+ Ports allows a set of ports to be exposed by the underlying v1.Service & v1.ContainerPort. By default, the operator
+will attempt to infer the required ports by parsing the .Spec.Config property but this property can be
+used to open additional ports that can't be inferred by the operator, like for custom receivers. + |
+ false | +
| priorityClassName | +string | +
+ If specified, indicates the pod's priority.
+If not specified, the pod priority will be default or zero if there is no
+default. + |
+ false | +
| prometheusCR | +object | +
+ PrometheusCR defines the configuration for the retrieval of PrometheusOperator CRDs ( servicemonitor.monitoring.coreos.com/v1 and podmonitor.monitoring.coreos.com/v1 ). + |
+ false | +
| replicas | +integer | +
+ Replicas is the number of pod instances for the underlying replicaset. Set this if you are not using autoscaling. + + Format: int32 + |
+ false | +
| resources | +object | +
+ Resources to set on generated pods. + |
+ false | +
| scrapeConfigs | +[]object | +
+ ScrapeConfigs define static Prometheus scrape configurations for the target allocator.
+To use dynamic configurations from ServiceMonitors and PodMonitors, see the PrometheusCR section.
+For the exact format, see https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config. + |
+ false | +
| securityContext | +object | +
+ SecurityContext configures the container security context for
+the generated main container.
+
+In deployment, daemonset, or statefulset mode, this controls
+the security context settings for the primary application
+container.
+
+In sidecar mode, this controls the security context for the
+injected sidecar container. + |
+ false | +
| serviceAccount | +string | +
+ ServiceAccount indicates the name of an existing service account to use with this instance. When set,
+the operator will not automatically create a ServiceAccount. + |
+ false | +
| shareProcessNamespace | +boolean | +
+ ShareProcessNamespace indicates if the pod's containers should share process namespace. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Duration in seconds the pod needs to terminate gracefully upon probe failure. + + Format: int64 + |
+ false | +
| tolerations | +[]object | +
+ Toleration to schedule the generated pods.
+This only works with the following OpenTelemetryCollector mode's: daemonset, statefulset, and deployment. + |
+ false | +
| topologySpreadConstraints | +[]object | +
+ TopologySpreadConstraints embedded kubernetes pod configuration option,
+controls how pods are spread across your cluster among failure-domains
+such as regions, zones, nodes, and other user-defined topology domains
+https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+This only works with the following OpenTelemetryCollector mode's: statefulset, and deployment. + |
+ false | +
| volumeMounts | +[]object | +
+ VolumeMounts represents the mount points to use in the underlying deployment(s). + |
+ false | +
| volumes | +[]object | +
+ Volumes represents which volumes to use in the underlying deployment(s). + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the container specified as a DNS_LABEL.
+Each container in a pod must have a unique name (DNS_LABEL).
+Cannot be updated. + |
+ true | +
| args | +[]string | +
+ Arguments to the entrypoint.
+The container image's CMD is used if this is not provided.
+Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+of whether the variable exists or not. Cannot be updated.
+More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + |
+ false | +
| command | +[]string | +
+ Entrypoint array. Not executed within a shell.
+The container image's ENTRYPOINT is used if this is not provided.
+Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+of whether the variable exists or not. Cannot be updated.
+More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + |
+ false | +
| env | +[]object | +
+ List of environment variables to set in the container.
+Cannot be updated. + |
+ false | +
| envFrom | +[]object | +
+ List of sources to populate environment variables in the container.
+The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+will be reported as an event when the container is starting. When a key exists in multiple
+sources, the value associated with the last source will take precedence.
+Values defined by an Env with a duplicate key will take precedence.
+Cannot be updated. + |
+ false | +
| image | +string | +
+ Container image name.
+More info: https://kubernetes.io/docs/concepts/containers/images
+This field is optional to allow higher level config management to default or override
+container images in workload controllers like Deployments and StatefulSets. + |
+ false | +
| imagePullPolicy | +string | +
+ Image pull policy.
+One of Always, Never, IfNotPresent.
+Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + |
+ false | +
| lifecycle | +object | +
+ Actions that the management system should take in response to container lifecycle events.
+Cannot be updated. + |
+ false | +
| livenessProbe | +object | +
+ Periodic probe of container liveness.
+Container will be restarted if the probe fails.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| ports | +[]object | +
+ List of ports to expose from the container. Not specifying a port here
+DOES NOT prevent that port from being exposed. Any port which is
+listening on the default "0.0.0.0" address inside a container will be
+accessible from the network.
+Modifying this array with strategic merge patch may corrupt the data.
+For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+Cannot be updated. + |
+ false | +
| readinessProbe | +object | +
+ Periodic probe of container service readiness.
+Container will be removed from service endpoints if the probe fails.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| resizePolicy | +[]object | +
+ Resources resize policy for the container. + |
+ false | +
| resources | +object | +
+ Compute Resources required by this container.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| restartPolicy | +string | +
+ RestartPolicy defines the restart behavior of individual containers in a pod.
+This field may only be set for init containers, and the only allowed value is "Always".
+For non-init containers or when this field is not specified,
+the restart behavior is defined by the Pod's restart policy and the container type.
+Setting the RestartPolicy as "Always" for the init container will have the following effect:
+this init container will be continually restarted on
+exit until all regular containers have terminated. Once all regular
+containers have completed, all init containers with restartPolicy "Always"
+will be shut down. This lifecycle differs from normal init containers and
+is often referred to as a "sidecar" container. Although this init
+container still starts in the init container sequence, it does not wait
+for the container to complete before proceeding to the next init
+container. Instead, the next init container starts immediately after this
+init container is started, or after any startupProbe has successfully
+completed. + |
+ false | +
| securityContext | +object | +
+ SecurityContext defines the security options the container should be run with.
+If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + |
+ false | +
| startupProbe | +object | +
+ StartupProbe indicates that the Pod has successfully initialized.
+If specified, no other probes are executed until this completes successfully.
+If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+when it might take a long time to load data or warm a cache, than during steady-state operation.
+This cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| stdin | +boolean | +
+ Whether this container should allocate a buffer for stdin in the container runtime. If this
+is not set, reads from stdin in the container will always result in EOF.
+Default is false. + |
+ false | +
| stdinOnce | +boolean | +
+ Whether the container runtime should close the stdin channel after it has been opened by
+a single attach. When stdin is true the stdin stream will remain open across multiple attach
+sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+at which time stdin is closed and remains closed until the container is restarted. If this
+flag is false, a container processes that reads from stdin will never receive an EOF.
+Default is false + |
+ false | +
| terminationMessagePath | +string | +
+ Optional: Path at which the file to which the container's termination message
+will be written is mounted into the container's filesystem.
+Message written is intended to be brief final status, such as an assertion failure message.
+Will be truncated by the node if greater than 4096 bytes. The total message length across
+all containers will be limited to 12kb.
+Defaults to /dev/termination-log.
+Cannot be updated. + |
+ false | +
| terminationMessagePolicy | +string | +
+ Indicate how the termination message should be populated. File will use the contents of
+terminationMessagePath to populate the container status message on both success and failure.
+FallbackToLogsOnError will use the last chunk of container log output if the termination
+message file is empty and the container exited with an error.
+The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+Defaults to File.
+Cannot be updated. + |
+ false | +
| tty | +boolean | +
+ Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+Default is false. + |
+ false | +
| volumeDevices | +[]object | +
+ volumeDevices is the list of block devices to be used by the container. + |
+ false | +
| volumeMounts | +[]object | +
+ Pod volumes to mount into the container's filesystem.
+Cannot be updated. + |
+ false | +
| workingDir | +string | +
+ Container's working directory.
+If not specified, the container runtime's default will be used, which
+might be configured in the container image.
+Cannot be updated. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the environment variable. Must be a C_IDENTIFIER. + |
+ true | +
| value | +string | +
+ Variable references $(VAR_NAME) are expanded
+using the previously defined environment variables in the container and
+any service environment variables. If a variable cannot be resolved,
+the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+"$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+Escaped references will never be expanded, regardless of whether the variable
+exists or not.
+Defaults to "". + |
+ false | +
| valueFrom | +object | +
+ Source for the environment variable's value. Cannot be used if value is not empty. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapKeyRef | +object | +
+ Selects a key of a ConfigMap. + |
+ false | +
| fieldRef | +object | +
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels[' + |
+ false | +
| resourceFieldRef | +object | +
+ Selects a resource of the container: only resources limits and requests
+(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + |
+ false | +
| secretKeyRef | +object | +
+ Selects a key of a secret in the pod's namespace + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key to select. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fieldPath | +string | +
+ Path of the field to select in the specified API version. + |
+ true | +
| apiVersion | +string | +
+ Version of the schema the FieldPath is written in terms of, defaults to "v1". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resource | +string | +
+ Required: resource to select + |
+ true | +
| containerName | +string | +
+ Container name: required for volumes, optional for env vars + |
+ false | +
| divisor | +int or string | +
+ Specifies the output format of the exposed resources, defaults to "1" + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key of the secret to select from. Must be a valid secret key. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapRef | +object | +
+ The ConfigMap to select from + |
+ false | +
| prefix | +string | +
+ An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + |
+ false | +
| secretRef | +object | +
+ The Secret to select from + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| postStart | +object | +
+ PostStart is called immediately after a container is created. If the handler fails,
+the container is terminated and restarted according to its restart policy.
+Other management of the container blocks until the hook completes.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| preStop | +object | +
+ PreStop is called immediately before a container is terminated due to an
+API request or management event such as liveness/startup probe failure,
+preemption, resource contention, etc. The handler is not called if the
+container crashes or exits. The Pod's termination grace period countdown begins before the
+PreStop hook is executed. Regardless of the outcome of the handler, the
+container will eventually terminate within the Pod's termination grace
+period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+or until the termination grace period is reached.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| containerPort | +integer | +
+ Number of port to expose on the pod's IP address.
+This must be a valid port number, 0 < x < 65536. + + Format: int32 + |
+ true | +
| hostIP | +string | +
+ What host IP to bind the external port to. + |
+ false | +
| hostPort | +integer | +
+ Number of port to expose on the host.
+If specified, this must be a valid port number, 0 < x < 65536.
+If HostNetwork is specified, this must match ContainerPort.
+Most containers do not need this. + + Format: int32 + |
+ false | +
| name | +string | +
+ If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+named port in a pod must have a unique name. Name for the port that can be
+referred to by services. + |
+ false | +
| protocol | +string | +
+ Protocol for port. Must be UDP, TCP, or SCTP.
+Defaults to "TCP". + + Default: TCP + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resourceName | +string | +
+ Name of the resource to which this resource resize policy applies.
+Supported values: cpu, memory. + |
+ true | +
| restartPolicy | +string | +
+ Restart policy to apply when specified resource is resized.
+If not specified, it defaults to NotRequired. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| claims | +[]object | +
+ Claims lists the names of resources, defined in spec.resourceClaims,
+that are used by this container.
+
+This is an alpha field and requires enabling the
+DynamicResourceAllocation feature gate.
+
+This field is immutable. It can only be set for containers. + |
+ false | +
| limits | +map[string]int or string | +
+ Limits describes the maximum amount of compute resources allowed.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| requests | +map[string]int or string | +
+ Requests describes the minimum amount of compute resources required.
+If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+otherwise to an implementation-defined value. Requests cannot exceed Limits.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name must match the name of one entry in pod.spec.resourceClaims of
+the Pod where this field is used. It makes that resource available
+inside a container. + |
+ true | +
| request | +string | +
+ Request is the name chosen for a request in the referenced claim.
+If empty, everything from the claim is made available, otherwise
+only the result of this request. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| allowPrivilegeEscalation | +boolean | +
+ AllowPrivilegeEscalation controls whether a process can gain more
+privileges than its parent process. This bool directly controls if
+the no_new_privs flag will be set on the container process.
+AllowPrivilegeEscalation is true always when the container is:
+1) run as Privileged
+2) has CAP_SYS_ADMIN
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| appArmorProfile | +object | +
+ appArmorProfile is the AppArmor options to use by this container. If set, this profile
+overrides the pod's appArmorProfile.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| capabilities | +object | +
+ The capabilities to add/drop when running containers.
+Defaults to the default set of capabilities granted by the container runtime.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| privileged | +boolean | +
+ Run container in privileged mode.
+Processes in privileged containers are essentially equivalent to root on the host.
+Defaults to false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| procMount | +string | +
+ procMount denotes the type of proc mount to use for the containers.
+The default value is Default which uses the container runtime defaults for
+readonly paths and masked paths.
+This requires the ProcMountType feature flag to be enabled.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| readOnlyRootFilesystem | +boolean | +
+ Whether this container has a read-only root filesystem.
+Default is false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| runAsGroup | +integer | +
+ The GID to run the entrypoint of the container process.
+Uses runtime default if unset.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| runAsNonRoot | +boolean | +
+ Indicates that the container must run as a non-root user.
+If true, the Kubelet will validate the image at runtime to ensure that it
+does not run as UID 0 (root) and fail to start the container if it does.
+If unset or false, no such validation will be performed.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| runAsUser | +integer | +
+ The UID to run the entrypoint of the container process.
+Defaults to user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| seLinuxOptions | +object | +
+ The SELinux context to be applied to the container.
+If unspecified, the container runtime will allocate a random SELinux context for each
+container. May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| seccompProfile | +object | +
+ The seccomp options to use by this container. If seccomp options are
+provided at both the pod & container level, the container options
+override the pod options.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| windowsOptions | +object | +
+ The Windows specific settings applied to all containers.
+If unspecified, the options from the PodSecurityContext will be used.
+If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is linux. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of AppArmor profile will be applied.
+Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile loaded on the node that should be used.
+The profile must be preconfigured on the node to work.
+Must match the loaded name of the profile.
+Must be set if and only if type is "Localhost". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| add | +[]string | +
+ Added capabilities + |
+ false | +
| drop | +[]string | +
+ Removed capabilities + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| level | +string | +
+ Level is SELinux level label that applies to the container. + |
+ false | +
| role | +string | +
+ Role is a SELinux role label that applies to the container. + |
+ false | +
| type | +string | +
+ Type is a SELinux type label that applies to the container. + |
+ false | +
| user | +string | +
+ User is a SELinux user label that applies to the container. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of seccomp profile will be applied.
+Valid options are:
+
+Localhost - a profile defined in a file on the node should be used.
+RuntimeDefault - the container runtime default profile should be used.
+Unconfined - no profile should be applied. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile defined in a file on the node should be used.
+The profile must be preconfigured on the node to work.
+Must be a descending path, relative to the kubelet's configured seccomp profile location.
+Must be set if type is "Localhost". Must NOT be set for any other type. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| gmsaCredentialSpec | +string | +
+ GMSACredentialSpec is where the GMSA admission webhook
+(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+GMSA credential spec named by the GMSACredentialSpecName field. + |
+ false | +
| gmsaCredentialSpecName | +string | +
+ GMSACredentialSpecName is the name of the GMSA credential spec to use. + |
+ false | +
| hostProcess | +boolean | +
+ HostProcess determines if a container should be run as a 'Host Process' container.
+All of a Pod's containers must have the same effective HostProcess value
+(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+In addition, if HostProcess is true then HostNetwork must also be set to true. + |
+ false | +
| runAsUserName | +string | +
+ The UserName in Windows to run the entrypoint of the container process.
+Defaults to the user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| devicePath | +string | +
+ devicePath is the path inside of the container that the device will be mapped to. + |
+ true | +
| name | +string | +
+ name must match the name of a persistentVolumeClaim in the pod + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| mountPath | +string | +
+ Path within the container at which the volume should be mounted. Must
+not contain ':'. + |
+ true | +
| name | +string | +
+ This must match the Name of a Volume. + |
+ true | +
| mountPropagation | +string | +
+ mountPropagation determines how mounts are propagated from the host
+to container and the other way around.
+When not set, MountPropagationNone is used.
+This field is beta in 1.10.
+When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+(which defaults to None). + |
+ false | +
| readOnly | +boolean | +
+ Mounted read-only if true, read-write otherwise (false or unspecified).
+Defaults to false. + |
+ false | +
| recursiveReadOnly | +string | +
+ RecursiveReadOnly specifies whether read-only mounts should be handled
+recursively.
+
+If ReadOnly is false, this field has no meaning and must be unspecified.
+
+If ReadOnly is true, and this field is set to Disabled, the mount is not made
+recursively read-only. If this field is set to IfPossible, the mount is made
+recursively read-only, if it is supported by the container runtime. If this
+field is set to Enabled, the mount is made recursively read-only if it is
+supported by the container runtime, otherwise the pod will not be started and
+an error will be generated to indicate the reason.
+
+If this field is set to IfPossible or Enabled, MountPropagation must be set to
+None (or be unspecified, which defaults to None).
+
+If this field is not specified, it is treated as an equivalent of Disabled. + |
+ false | +
| subPath | +string | +
+ Path within the volume from which the container's volume should be mounted.
+Defaults to "" (volume's root). + |
+ false | +
| subPathExpr | +string | +
+ Expanded path within the volume from which the container's volume should be mounted.
+Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+Defaults to "" (volume's root).
+SubPathExpr and SubPath are mutually exclusive. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| nodeAffinity | +object | +
+ Describes node affinity scheduling rules for the pod. + |
+ false | +
| podAffinity | +object | +
+ Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + |
+ false | +
| podAntiAffinity | +object | +
+ Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | +[]object | +
+ The scheduler will prefer to schedule pods to nodes that satisfy
+the affinity expressions specified by this field, but it may choose
+a node that violates one or more of the expressions. The node that is
+most preferred is the one with the greatest sum of weights, i.e.
+for each node that meets all of the scheduling requirements (resource
+request, requiredDuringScheduling affinity expressions, etc.),
+compute a sum by iterating through the elements of this field and adding
+"weight" to the sum if the node matches the corresponding matchExpressions; the
+node(s) with the highest sum are the most preferred. + |
+ false | +
| requiredDuringSchedulingIgnoredDuringExecution | +object | +
+ If the affinity requirements specified by this field are not met at
+scheduling time, the pod will not be scheduled onto the node.
+If the affinity requirements specified by this field cease to be met
+at some point during pod execution (e.g. due to an update), the system
+may or may not try to eventually evict the pod from its node. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| preference | +object | +
+ A node selector term, associated with the corresponding weight. + |
+ true | +
| weight | +integer | +
+ Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + + Format: int32 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ A list of node selector requirements by node's labels. + |
+ false | +
| matchFields | +[]object | +
+ A list of node selector requirements by node's fields. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ Represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + |
+ true | +
| values | +[]string | +
+ An array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. If the operator is Gt or Lt, the values
+array must have a single element, which will be interpreted as an integer.
+This array is replaced during a strategic merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ Represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + |
+ true | +
| values | +[]string | +
+ An array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. If the operator is Gt or Lt, the values
+array must have a single element, which will be interpreted as an integer.
+This array is replaced during a strategic merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| nodeSelectorTerms | +[]object | +
+ Required. A list of node selector terms. The terms are ORed. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ A list of node selector requirements by node's labels. + |
+ false | +
| matchFields | +[]object | +
+ A list of node selector requirements by node's fields. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ Represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + |
+ true | +
| values | +[]string | +
+ An array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. If the operator is Gt or Lt, the values
+array must have a single element, which will be interpreted as an integer.
+This array is replaced during a strategic merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ Represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + |
+ true | +
| values | +[]string | +
+ An array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. If the operator is Gt or Lt, the values
+array must have a single element, which will be interpreted as an integer.
+This array is replaced during a strategic merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | +[]object | +
+ The scheduler will prefer to schedule pods to nodes that satisfy
+the affinity expressions specified by this field, but it may choose
+a node that violates one or more of the expressions. The node that is
+most preferred is the one with the greatest sum of weights, i.e.
+for each node that meets all of the scheduling requirements (resource
+request, requiredDuringScheduling affinity expressions, etc.),
+compute a sum by iterating through the elements of this field and adding
+"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+node(s) with the highest sum are the most preferred. + |
+ false | +
| requiredDuringSchedulingIgnoredDuringExecution | +[]object | +
+ If the affinity requirements specified by this field are not met at
+scheduling time, the pod will not be scheduled onto the node.
+If the affinity requirements specified by this field cease to be met
+at some point during pod execution (e.g. due to a pod label update), the
+system may or may not try to eventually evict the pod from its node.
+When there are multiple elements, the lists of nodes corresponding to each
+podAffinityTerm are intersected, i.e. all terms must be satisfied. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| podAffinityTerm | +object | +
+ Required. A pod affinity term, associated with the corresponding weight. + |
+ true | +
| weight | +integer | +
+ weight associated with matching the corresponding podAffinityTerm,
+in the range 1-100. + + Format: int32 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| topologyKey | +string | +
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+the labelSelector in the specified namespaces, where co-located is defined as running on a node
+whose value of the label with key topologyKey matches that of any node on which any of the
+selected pods is running.
+Empty topologyKey is not allowed. + |
+ true | +
| labelSelector | +object | +
+ A label query over a set of resources, in this case pods.
+If it's null, this PodAffinityTerm matches with no Pods. + |
+ false | +
| matchLabelKeys | +[]string | +
+ MatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+Also, matchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| mismatchLabelKeys | +[]string | +
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| namespaceSelector | +object | +
+ A label query over the set of namespaces that the term applies to.
+The term is applied to the union of the namespaces selected by this field
+and the ones listed in the namespaces field.
+null selector and null or empty namespaces list means "this pod's namespace".
+An empty selector ({}) matches all namespaces. + |
+ false | +
| namespaces | +[]string | +
+ namespaces specifies a static list of namespace names that the term applies to.
+The term is applied to the union of the namespaces listed in this field
+and the ones selected by namespaceSelector.
+null or empty namespaces list and null namespaceSelector means "this pod's namespace". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| topologyKey | +string | +
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+the labelSelector in the specified namespaces, where co-located is defined as running on a node
+whose value of the label with key topologyKey matches that of any node on which any of the
+selected pods is running.
+Empty topologyKey is not allowed. + |
+ true | +
| labelSelector | +object | +
+ A label query over a set of resources, in this case pods.
+If it's null, this PodAffinityTerm matches with no Pods. + |
+ false | +
| matchLabelKeys | +[]string | +
+ MatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+Also, matchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| mismatchLabelKeys | +[]string | +
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| namespaceSelector | +object | +
+ A label query over the set of namespaces that the term applies to.
+The term is applied to the union of the namespaces selected by this field
+and the ones listed in the namespaces field.
+null selector and null or empty namespaces list means "this pod's namespace".
+An empty selector ({}) matches all namespaces. + |
+ false | +
| namespaces | +[]string | +
+ namespaces specifies a static list of namespace names that the term applies to.
+The term is applied to the union of the namespaces listed in this field
+and the ones selected by namespaceSelector.
+null or empty namespaces list and null namespaceSelector means "this pod's namespace". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| preferredDuringSchedulingIgnoredDuringExecution | +[]object | +
+ The scheduler will prefer to schedule pods to nodes that satisfy
+the anti-affinity expressions specified by this field, but it may choose
+a node that violates one or more of the expressions. The node that is
+most preferred is the one with the greatest sum of weights, i.e.
+for each node that meets all of the scheduling requirements (resource
+request, requiredDuringScheduling anti-affinity expressions, etc.),
+compute a sum by iterating through the elements of this field and adding
+"weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+node(s) with the highest sum are the most preferred. + |
+ false | +
| requiredDuringSchedulingIgnoredDuringExecution | +[]object | +
+ If the anti-affinity requirements specified by this field are not met at
+scheduling time, the pod will not be scheduled onto the node.
+If the anti-affinity requirements specified by this field cease to be met
+at some point during pod execution (e.g. due to a pod label update), the
+system may or may not try to eventually evict the pod from its node.
+When there are multiple elements, the lists of nodes corresponding to each
+podAffinityTerm are intersected, i.e. all terms must be satisfied. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| podAffinityTerm | +object | +
+ Required. A pod affinity term, associated with the corresponding weight. + |
+ true | +
| weight | +integer | +
+ weight associated with matching the corresponding podAffinityTerm,
+in the range 1-100. + + Format: int32 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| topologyKey | +string | +
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+the labelSelector in the specified namespaces, where co-located is defined as running on a node
+whose value of the label with key topologyKey matches that of any node on which any of the
+selected pods is running.
+Empty topologyKey is not allowed. + |
+ true | +
| labelSelector | +object | +
+ A label query over a set of resources, in this case pods.
+If it's null, this PodAffinityTerm matches with no Pods. + |
+ false | +
| matchLabelKeys | +[]string | +
+ MatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+Also, matchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| mismatchLabelKeys | +[]string | +
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| namespaceSelector | +object | +
+ A label query over the set of namespaces that the term applies to.
+The term is applied to the union of the namespaces selected by this field
+and the ones listed in the namespaces field.
+null selector and null or empty namespaces list means "this pod's namespace".
+An empty selector ({}) matches all namespaces. + |
+ false | +
| namespaces | +[]string | +
+ namespaces specifies a static list of namespace names that the term applies to.
+The term is applied to the union of the namespaces listed in this field
+and the ones selected by namespaceSelector.
+null or empty namespaces list and null namespaceSelector means "this pod's namespace". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| topologyKey | +string | +
+ This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+the labelSelector in the specified namespaces, where co-located is defined as running on a node
+whose value of the label with key topologyKey matches that of any node on which any of the
+selected pods is running.
+Empty topologyKey is not allowed. + |
+ true | +
| labelSelector | +object | +
+ A label query over a set of resources, in this case pods.
+If it's null, this PodAffinityTerm matches with no Pods. + |
+ false | +
| matchLabelKeys | +[]string | +
+ MatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+Also, matchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| mismatchLabelKeys | +[]string | +
+ MismatchLabelKeys is a set of pod label keys to select which pods will
+be taken into consideration. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+to select the group of existing pods which pods will be taken into consideration
+for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+pod labels will be ignored. The default value is empty.
+The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + |
+ false | +
| namespaceSelector | +object | +
+ A label query over the set of namespaces that the term applies to.
+The term is applied to the union of the namespaces selected by this field
+and the ones listed in the namespaces field.
+null selector and null or empty namespaces list means "this pod's namespace".
+An empty selector ({}) matches all namespaces. + |
+ false | +
| namespaces | +[]string | +
+ namespaces specifies a static list of namespace names that the term applies to.
+The term is applied to the union of the namespaces listed in this field
+and the ones selected by namespaceSelector.
+null or empty namespaces list and null namespaceSelector means "this pod's namespace". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the environment variable. Must be a C_IDENTIFIER. + |
+ true | +
| value | +string | +
+ Variable references $(VAR_NAME) are expanded
+using the previously defined environment variables in the container and
+any service environment variables. If a variable cannot be resolved,
+the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+"$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+Escaped references will never be expanded, regardless of whether the variable
+exists or not.
+Defaults to "". + |
+ false | +
| valueFrom | +object | +
+ Source for the environment variable's value. Cannot be used if value is not empty. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapKeyRef | +object | +
+ Selects a key of a ConfigMap. + |
+ false | +
| fieldRef | +object | +
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels[' + |
+ false | +
| resourceFieldRef | +object | +
+ Selects a resource of the container: only resources limits and requests
+(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + |
+ false | +
| secretKeyRef | +object | +
+ Selects a key of a secret in the pod's namespace + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key to select. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fieldPath | +string | +
+ Path of the field to select in the specified API version. + |
+ true | +
| apiVersion | +string | +
+ Version of the schema the FieldPath is written in terms of, defaults to "v1". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resource | +string | +
+ Required: resource to select + |
+ true | +
| containerName | +string | +
+ Container name: required for volumes, optional for env vars + |
+ false | +
| divisor | +int or string | +
+ Specifies the output format of the exposed resources, defaults to "1" + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key of the secret to select from. Must be a valid secret key. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapRef | +object | +
+ The ConfigMap to select from + |
+ false | +
| prefix | +string | +
+ An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + |
+ false | +
| secretRef | +object | +
+ The Secret to select from + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the container specified as a DNS_LABEL.
+Each container in a pod must have a unique name (DNS_LABEL).
+Cannot be updated. + |
+ true | +
| args | +[]string | +
+ Arguments to the entrypoint.
+The container image's CMD is used if this is not provided.
+Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+of whether the variable exists or not. Cannot be updated.
+More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + |
+ false | +
| command | +[]string | +
+ Entrypoint array. Not executed within a shell.
+The container image's ENTRYPOINT is used if this is not provided.
+Variable references $(VAR_NAME) are expanded using the container's environment. If a variable
+cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will
+produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless
+of whether the variable exists or not. Cannot be updated.
+More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + |
+ false | +
| env | +[]object | +
+ List of environment variables to set in the container.
+Cannot be updated. + |
+ false | +
| envFrom | +[]object | +
+ List of sources to populate environment variables in the container.
+The keys defined within a source must be a C_IDENTIFIER. All invalid keys
+will be reported as an event when the container is starting. When a key exists in multiple
+sources, the value associated with the last source will take precedence.
+Values defined by an Env with a duplicate key will take precedence.
+Cannot be updated. + |
+ false | +
| image | +string | +
+ Container image name.
+More info: https://kubernetes.io/docs/concepts/containers/images
+This field is optional to allow higher level config management to default or override
+container images in workload controllers like Deployments and StatefulSets. + |
+ false | +
| imagePullPolicy | +string | +
+ Image pull policy.
+One of Always, Never, IfNotPresent.
+Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + |
+ false | +
| lifecycle | +object | +
+ Actions that the management system should take in response to container lifecycle events.
+Cannot be updated. + |
+ false | +
| livenessProbe | +object | +
+ Periodic probe of container liveness.
+Container will be restarted if the probe fails.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| ports | +[]object | +
+ List of ports to expose from the container. Not specifying a port here
+DOES NOT prevent that port from being exposed. Any port which is
+listening on the default "0.0.0.0" address inside a container will be
+accessible from the network.
+Modifying this array with strategic merge patch may corrupt the data.
+For more information See https://github.com/kubernetes/kubernetes/issues/108255.
+Cannot be updated. + |
+ false | +
| readinessProbe | +object | +
+ Periodic probe of container service readiness.
+Container will be removed from service endpoints if the probe fails.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| resizePolicy | +[]object | +
+ Resources resize policy for the container. + |
+ false | +
| resources | +object | +
+ Compute Resources required by this container.
+Cannot be updated.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| restartPolicy | +string | +
+ RestartPolicy defines the restart behavior of individual containers in a pod.
+This field may only be set for init containers, and the only allowed value is "Always".
+For non-init containers or when this field is not specified,
+the restart behavior is defined by the Pod's restart policy and the container type.
+Setting the RestartPolicy as "Always" for the init container will have the following effect:
+this init container will be continually restarted on
+exit until all regular containers have terminated. Once all regular
+containers have completed, all init containers with restartPolicy "Always"
+will be shut down. This lifecycle differs from normal init containers and
+is often referred to as a "sidecar" container. Although this init
+container still starts in the init container sequence, it does not wait
+for the container to complete before proceeding to the next init
+container. Instead, the next init container starts immediately after this
+init container is started, or after any startupProbe has successfully
+completed. + |
+ false | +
| securityContext | +object | +
+ SecurityContext defines the security options the container should be run with.
+If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + |
+ false | +
| startupProbe | +object | +
+ StartupProbe indicates that the Pod has successfully initialized.
+If specified, no other probes are executed until this completes successfully.
+If this probe fails, the Pod will be restarted, just as if the livenessProbe failed.
+This can be used to provide different probe parameters at the beginning of a Pod's lifecycle,
+when it might take a long time to load data or warm a cache, than during steady-state operation.
+This cannot be updated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + |
+ false | +
| stdin | +boolean | +
+ Whether this container should allocate a buffer for stdin in the container runtime. If this
+is not set, reads from stdin in the container will always result in EOF.
+Default is false. + |
+ false | +
| stdinOnce | +boolean | +
+ Whether the container runtime should close the stdin channel after it has been opened by
+a single attach. When stdin is true the stdin stream will remain open across multiple attach
+sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the
+first client attaches to stdin, and then remains open and accepts data until the client disconnects,
+at which time stdin is closed and remains closed until the container is restarted. If this
+flag is false, a container processes that reads from stdin will never receive an EOF.
+Default is false + |
+ false | +
| terminationMessagePath | +string | +
+ Optional: Path at which the file to which the container's termination message
+will be written is mounted into the container's filesystem.
+Message written is intended to be brief final status, such as an assertion failure message.
+Will be truncated by the node if greater than 4096 bytes. The total message length across
+all containers will be limited to 12kb.
+Defaults to /dev/termination-log.
+Cannot be updated. + |
+ false | +
| terminationMessagePolicy | +string | +
+ Indicate how the termination message should be populated. File will use the contents of
+terminationMessagePath to populate the container status message on both success and failure.
+FallbackToLogsOnError will use the last chunk of container log output if the termination
+message file is empty and the container exited with an error.
+The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
+Defaults to File.
+Cannot be updated. + |
+ false | +
| tty | +boolean | +
+ Whether this container should allocate a TTY for itself, also requires 'stdin' to be true.
+Default is false. + |
+ false | +
| volumeDevices | +[]object | +
+ volumeDevices is the list of block devices to be used by the container. + |
+ false | +
| volumeMounts | +[]object | +
+ Pod volumes to mount into the container's filesystem.
+Cannot be updated. + |
+ false | +
| workingDir | +string | +
+ Container's working directory.
+If not specified, the container runtime's default will be used, which
+might be configured in the container image.
+Cannot be updated. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the environment variable. Must be a C_IDENTIFIER. + |
+ true | +
| value | +string | +
+ Variable references $(VAR_NAME) are expanded
+using the previously defined environment variables in the container and
+any service environment variables. If a variable cannot be resolved,
+the reference in the input string will be unchanged. Double $$ are reduced
+to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+"$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+Escaped references will never be expanded, regardless of whether the variable
+exists or not.
+Defaults to "". + |
+ false | +
| valueFrom | +object | +
+ Source for the environment variable's value. Cannot be used if value is not empty. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapKeyRef | +object | +
+ Selects a key of a ConfigMap. + |
+ false | +
| fieldRef | +object | +
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels[' + |
+ false | +
| resourceFieldRef | +object | +
+ Selects a resource of the container: only resources limits and requests
+(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + |
+ false | +
| secretKeyRef | +object | +
+ Selects a key of a secret in the pod's namespace + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key to select. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| fieldPath | +string | +
+ Path of the field to select in the specified API version. + |
+ true | +
| apiVersion | +string | +
+ Version of the schema the FieldPath is written in terms of, defaults to "v1". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resource | +string | +
+ Required: resource to select + |
+ true | +
| containerName | +string | +
+ Container name: required for volumes, optional for env vars + |
+ false | +
| divisor | +int or string | +
+ Specifies the output format of the exposed resources, defaults to "1" + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ The key of the secret to select from. Must be a valid secret key. + |
+ true | +
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret or its key must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| configMapRef | +object | +
+ The ConfigMap to select from + |
+ false | +
| prefix | +string | +
+ An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + |
+ false | +
| secretRef | +object | +
+ The Secret to select from + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the ConfigMap must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of the referent.
+This field is effectively required, but due to backwards compatibility is
+allowed to be empty. Instances of this type with an empty value here are
+almost certainly wrong.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + Default: + |
+ false | +
| optional | +boolean | +
+ Specify whether the Secret must be defined + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| postStart | +object | +
+ PostStart is called immediately after a container is created. If the handler fails,
+the container is terminated and restarted according to its restart policy.
+Other management of the container blocks until the hook completes.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| preStop | +object | +
+ PreStop is called immediately before a container is terminated due to an
+API request or management event such as liveness/startup probe failure,
+preemption, resource contention, etc. The handler is not called if the
+container crashes or exits. The Pod's termination grace period countdown begins before the
+PreStop hook is executed. Regardless of the outcome of the handler, the
+container will eventually terminate within the Pod's termination grace
+period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+or until the termination grace period is reached.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| containerPort | +integer | +
+ Number of port to expose on the pod's IP address.
+This must be a valid port number, 0 < x < 65536. + + Format: int32 + |
+ true | +
| hostIP | +string | +
+ What host IP to bind the external port to. + |
+ false | +
| hostPort | +integer | +
+ Number of port to expose on the host.
+If specified, this must be a valid port number, 0 < x < 65536.
+If HostNetwork is specified, this must match ContainerPort.
+Most containers do not need this. + + Format: int32 + |
+ false | +
| name | +string | +
+ If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
+named port in a pod must have a unique name. Name for the port that can be
+referred to by services. + |
+ false | +
| protocol | +string | +
+ Protocol for port. Must be UDP, TCP, or SCTP.
+Defaults to "TCP". + + Default: TCP + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| resourceName | +string | +
+ Name of the resource to which this resource resize policy applies.
+Supported values: cpu, memory. + |
+ true | +
| restartPolicy | +string | +
+ Restart policy to apply when specified resource is resized.
+If not specified, it defaults to NotRequired. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| claims | +[]object | +
+ Claims lists the names of resources, defined in spec.resourceClaims,
+that are used by this container.
+
+This is an alpha field and requires enabling the
+DynamicResourceAllocation feature gate.
+
+This field is immutable. It can only be set for containers. + |
+ false | +
| limits | +map[string]int or string | +
+ Limits describes the maximum amount of compute resources allowed.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| requests | +map[string]int or string | +
+ Requests describes the minimum amount of compute resources required.
+If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+otherwise to an implementation-defined value. Requests cannot exceed Limits.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name must match the name of one entry in pod.spec.resourceClaims of
+the Pod where this field is used. It makes that resource available
+inside a container. + |
+ true | +
| request | +string | +
+ Request is the name chosen for a request in the referenced claim.
+If empty, everything from the claim is made available, otherwise
+only the result of this request. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| allowPrivilegeEscalation | +boolean | +
+ AllowPrivilegeEscalation controls whether a process can gain more
+privileges than its parent process. This bool directly controls if
+the no_new_privs flag will be set on the container process.
+AllowPrivilegeEscalation is true always when the container is:
+1) run as Privileged
+2) has CAP_SYS_ADMIN
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| appArmorProfile | +object | +
+ appArmorProfile is the AppArmor options to use by this container. If set, this profile
+overrides the pod's appArmorProfile.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| capabilities | +object | +
+ The capabilities to add/drop when running containers.
+Defaults to the default set of capabilities granted by the container runtime.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| privileged | +boolean | +
+ Run container in privileged mode.
+Processes in privileged containers are essentially equivalent to root on the host.
+Defaults to false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| procMount | +string | +
+ procMount denotes the type of proc mount to use for the containers.
+The default value is Default which uses the container runtime defaults for
+readonly paths and masked paths.
+This requires the ProcMountType feature flag to be enabled.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| readOnlyRootFilesystem | +boolean | +
+ Whether this container has a read-only root filesystem.
+Default is false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| runAsGroup | +integer | +
+ The GID to run the entrypoint of the container process.
+Uses runtime default if unset.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| runAsNonRoot | +boolean | +
+ Indicates that the container must run as a non-root user.
+If true, the Kubelet will validate the image at runtime to ensure that it
+does not run as UID 0 (root) and fail to start the container if it does.
+If unset or false, no such validation will be performed.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| runAsUser | +integer | +
+ The UID to run the entrypoint of the container process.
+Defaults to user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| seLinuxOptions | +object | +
+ The SELinux context to be applied to the container.
+If unspecified, the container runtime will allocate a random SELinux context for each
+container. May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| seccompProfile | +object | +
+ The seccomp options to use by this container. If seccomp options are
+provided at both the pod & container level, the container options
+override the pod options.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| windowsOptions | +object | +
+ The Windows specific settings applied to all containers.
+If unspecified, the options from the PodSecurityContext will be used.
+If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is linux. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of AppArmor profile will be applied.
+Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile loaded on the node that should be used.
+The profile must be preconfigured on the node to work.
+Must match the loaded name of the profile.
+Must be set if and only if type is "Localhost". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| add | +[]string | +
+ Added capabilities + |
+ false | +
| drop | +[]string | +
+ Removed capabilities + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| level | +string | +
+ Level is SELinux level label that applies to the container. + |
+ false | +
| role | +string | +
+ Role is a SELinux role label that applies to the container. + |
+ false | +
| type | +string | +
+ Type is a SELinux type label that applies to the container. + |
+ false | +
| user | +string | +
+ User is a SELinux user label that applies to the container. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of seccomp profile will be applied.
+Valid options are:
+
+Localhost - a profile defined in a file on the node should be used.
+RuntimeDefault - the container runtime default profile should be used.
+Unconfined - no profile should be applied. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile defined in a file on the node should be used.
+The profile must be preconfigured on the node to work.
+Must be a descending path, relative to the kubelet's configured seccomp profile location.
+Must be set if type is "Localhost". Must NOT be set for any other type. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| gmsaCredentialSpec | +string | +
+ GMSACredentialSpec is where the GMSA admission webhook
+(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+GMSA credential spec named by the GMSACredentialSpecName field. + |
+ false | +
| gmsaCredentialSpecName | +string | +
+ GMSACredentialSpecName is the name of the GMSA credential spec to use. + |
+ false | +
| hostProcess | +boolean | +
+ HostProcess determines if a container should be run as a 'Host Process' container.
+All of a Pod's containers must have the same effective HostProcess value
+(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+In addition, if HostProcess is true then HostNetwork must also be set to true. + |
+ false | +
| runAsUserName | +string | +
+ The UserName in Windows to run the entrypoint of the container process.
+Defaults to the user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| failureThreshold | +integer | +
+ Minimum consecutive failures for the probe to be considered failed after having succeeded.
+Defaults to 3. Minimum value is 1. + + Format: int32 + |
+ false | +
| grpc | +object | +
+ GRPC specifies an action involving a GRPC port. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| initialDelaySeconds | +integer | +
+ Number of seconds after the container has started before liveness probes are initiated.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| periodSeconds | +integer | +
+ How often (in seconds) to perform the probe.
+Default to 10 seconds. Minimum value is 1. + + Format: int32 + |
+ false | +
| successThreshold | +integer | +
+ Minimum consecutive successes for the probe to be considered successful after having failed.
+Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + + Format: int32 + |
+ false | +
| tcpSocket | +object | +
+ TCPSocket specifies an action involving a TCP port. + |
+ false | +
| terminationGracePeriodSeconds | +integer | +
+ Optional duration in seconds the pod needs to terminate gracefully upon probe failure.
+The grace period is the duration in seconds after the processes running in the pod are sent
+a termination signal and the time when the processes are forcibly halted with a kill signal.
+Set this value longer than the expected cleanup time for your process.
+If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this
+value overrides the value provided by the pod spec.
+Value must be non-negative integer. The value zero indicates stop immediately via
+the kill signal (no opportunity to shut down).
+This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.
+Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + + Format: int64 + |
+ false | +
| timeoutSeconds | +integer | +
+ Number of seconds after which the probe times out.
+Defaults to 1 second. Minimum value is 1.
+More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + + Format: int32 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ Port number of the gRPC service. Number must be in the range 1 to 65535. + + Format: int32 + |
+ true | +
| service | +string | +
+ Service is the name of the service to place in the gRPC HealthCheckRequest
+(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).
+
+If this is not specified, the default behavior is defined by gRPC. + + Default: + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| devicePath | +string | +
+ devicePath is the path inside of the container that the device will be mapped to. + |
+ true | +
| name | +string | +
+ name must match the name of a persistentVolumeClaim in the pod + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| mountPath | +string | +
+ Path within the container at which the volume should be mounted. Must
+not contain ':'. + |
+ true | +
| name | +string | +
+ This must match the Name of a Volume. + |
+ true | +
| mountPropagation | +string | +
+ mountPropagation determines how mounts are propagated from the host
+to container and the other way around.
+When not set, MountPropagationNone is used.
+This field is beta in 1.10.
+When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+(which defaults to None). + |
+ false | +
| readOnly | +boolean | +
+ Mounted read-only if true, read-write otherwise (false or unspecified).
+Defaults to false. + |
+ false | +
| recursiveReadOnly | +string | +
+ RecursiveReadOnly specifies whether read-only mounts should be handled
+recursively.
+
+If ReadOnly is false, this field has no meaning and must be unspecified.
+
+If ReadOnly is true, and this field is set to Disabled, the mount is not made
+recursively read-only. If this field is set to IfPossible, the mount is made
+recursively read-only, if it is supported by the container runtime. If this
+field is set to Enabled, the mount is made recursively read-only if it is
+supported by the container runtime, otherwise the pod will not be started and
+an error will be generated to indicate the reason.
+
+If this field is set to IfPossible or Enabled, MountPropagation must be set to
+None (or be unspecified, which defaults to None).
+
+If this field is not specified, it is treated as an equivalent of Disabled. + |
+ false | +
| subPath | +string | +
+ Path within the volume from which the container's volume should be mounted.
+Defaults to "" (volume's root). + |
+ false | +
| subPathExpr | +string | +
+ Expanded path within the volume from which the container's volume should be mounted.
+Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+Defaults to "" (volume's root).
+SubPathExpr and SubPath are mutually exclusive. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| postStart | +object | +
+ PostStart is called immediately after a container is created. If the handler fails,
+the container is terminated and restarted according to its restart policy.
+Other management of the container blocks until the hook completes.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| preStop | +object | +
+ PreStop is called immediately before a container is terminated due to an
+API request or management event such as liveness/startup probe failure,
+preemption, resource contention, etc. The handler is not called if the
+container crashes or exits. The Pod's termination grace period countdown begins before the
+PreStop hook is executed. Regardless of the outcome of the handler, the
+container will eventually terminate within the Pod's termination grace
+period (unless delayed by finalizers). Other management of the container blocks until the hook completes
+or until the termination grace period is reached.
+More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| exec | +object | +
+ Exec specifies the action to take. + |
+ false | +
| httpGet | +object | +
+ HTTPGet specifies the http request to perform. + |
+ false | +
| sleep | +object | +
+ Sleep represents the duration that the container should sleep before being terminated. + |
+ false | +
| tcpSocket | +object | +
+ Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept
+for the backward compatibility. There are no validation of this field and
+lifecycle hooks will fail in runtime when tcp handler is specified. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| command | +[]string | +
+ Command is the command line to execute inside the container, the working directory for the
+command is root ('/') in the container's filesystem. The command is simply exec'd, it is
+not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
+a shell, you need to explicitly call out to that shell.
+Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Name or number of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Host name to connect to, defaults to the pod IP. You probably want to set
+"Host" in httpHeaders instead. + |
+ false | +
| httpHeaders | +[]object | +
+ Custom headers to set in the request. HTTP allows repeated headers. + |
+ false | +
| path | +string | +
+ Path to access on the HTTP server. + |
+ false | +
| scheme | +string | +
+ Scheme to use for connecting to the host.
+Defaults to HTTP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ The header field name.
+This will be canonicalized upon output, so case-variant names will be understood as the same header. + |
+ true | +
| value | +string | +
+ The header field value + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| seconds | +integer | +
+ Seconds is the number of seconds to sleep. + + Format: int64 + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +int or string | +
+ Number or name of the port to access on the container.
+Number must be in the range 1 to 65535.
+Name must be an IANA_SVC_NAME. + |
+ true | +
| host | +string | +
+ Optional: Host name to connect to, defaults to the pod IP. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| metrics | +object | +
+ Metrics defines the metrics configuration for operands. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| disablePrometheusAnnotations | +boolean | +
+ DisablePrometheusAnnotations controls the automatic addition of default Prometheus annotations
+('prometheus.io/scrape', 'prometheus.io/port', and 'prometheus.io/path') + |
+ false | +
| enableMetrics | +boolean | +
+ EnableMetrics specifies if ServiceMonitor or PodMonitor(for sidecar mode) should be created for the service managed by the OpenTelemetry Operator.
+The operator.observability.prometheus feature gate must be enabled to use this feature. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| maxUnavailable | +int or string | +
+ An eviction is allowed if at most "maxUnavailable" pods selected by
+"selector" are unavailable after the eviction, i.e. even in absence of
+the evicted pod. For example, one can prevent all voluntary evictions
+by specifying 0. This is a mutually exclusive setting with "minAvailable". + |
+ false | +
| minAvailable | +int or string | +
+ An eviction is allowed if at least "minAvailable" pods selected by
+"selector" will still be available after the eviction, i.e. even in the
+absence of the evicted pod. So for example you can prevent all voluntary
+evictions by specifying "100%". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| nameservers | +[]string | +
+ A list of DNS name server IP addresses.
+This will be appended to the base nameservers generated from DNSPolicy.
+Duplicated nameservers will be removed. + |
+ false | +
| options | +[]object | +
+ A list of DNS resolver options.
+This will be merged with the base options generated from DNSPolicy.
+Duplicated entries will be removed. Resolution options given in Options
+will override those that appear in the base DNSPolicy. + |
+ false | +
| searches | +[]string | +
+ A list of DNS search domains for host-name lookup.
+This will be appended to the base search paths generated from DNSPolicy.
+Duplicated search paths will be removed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Required. + |
+ false | +
| value | +string | +
+ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| appArmorProfile | +object | +
+ appArmorProfile is the AppArmor options to use by the containers in this pod.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| fsGroup | +integer | +
+ A special supplemental group that applies to all containers in a pod.
+Some volume types allow the Kubelet to change the ownership of that volume
+to be owned by the pod:
+
+1. The owning GID will be the FSGroup
+2. The setgid bit is set (new files created in the volume will be owned by FSGroup)
+3. The permission bits are OR'd with rw-rw----
+
+If unset, the Kubelet will not modify the ownership and permissions of any volume.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| fsGroupChangePolicy | +string | +
+ fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
+before being exposed inside Pod. This field will only apply to
+volume types which support fsGroup based ownership(and permissions).
+It will have no effect on ephemeral volume types such as: secret, configmaps
+and emptydir.
+Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| runAsGroup | +integer | +
+ The GID to run the entrypoint of the container process.
+Uses runtime default if unset.
+May also be set in SecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence
+for that container.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| runAsNonRoot | +boolean | +
+ Indicates that the container must run as a non-root user.
+If true, the Kubelet will validate the image at runtime to ensure that it
+does not run as UID 0 (root) and fail to start the container if it does.
+If unset or false, no such validation will be performed.
+May also be set in SecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| runAsUser | +integer | +
+ The UID to run the entrypoint of the container process.
+Defaults to user specified in image metadata if unspecified.
+May also be set in SecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence
+for that container.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| seLinuxOptions | +object | +
+ The SELinux context to be applied to all containers.
+If unspecified, the container runtime will allocate a random SELinux context for each
+container. May also be set in SecurityContext. If set in
+both SecurityContext and PodSecurityContext, the value specified in SecurityContext
+takes precedence for that container.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| seccompProfile | +object | +
+ The seccomp options to use by the containers in this pod.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| supplementalGroups | +[]integer | +
+ A list of groups applied to the first process run in each container, in
+addition to the container's primary GID and fsGroup (if specified). If
+the SupplementalGroupsPolicy feature is enabled, the
+supplementalGroupsPolicy field determines whether these are in addition
+to or instead of any group memberships defined in the container image.
+If unspecified, no additional groups are added, though group memberships
+defined in the container image may still be used, depending on the
+supplementalGroupsPolicy field.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| supplementalGroupsPolicy | +string | +
+ Defines how supplemental groups of the first container processes are calculated.
+Valid values are "Merge" and "Strict". If not specified, "Merge" is used.
+(Alpha) Using the field requires the SupplementalGroupsPolicy feature gate to be enabled
+and the container runtime must implement support for this feature.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| sysctls | +[]object | +
+ Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
+sysctls (by the container runtime) might fail to launch.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| windowsOptions | +object | +
+ The Windows specific settings applied to all containers.
+If unspecified, the options within a container's SecurityContext will be used.
+If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is linux. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of AppArmor profile will be applied.
+Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile loaded on the node that should be used.
+The profile must be preconfigured on the node to work.
+Must match the loaded name of the profile.
+Must be set if and only if type is "Localhost". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| level | +string | +
+ Level is SELinux level label that applies to the container. + |
+ false | +
| role | +string | +
+ Role is a SELinux role label that applies to the container. + |
+ false | +
| type | +string | +
+ Type is a SELinux type label that applies to the container. + |
+ false | +
| user | +string | +
+ User is a SELinux user label that applies to the container. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of seccomp profile will be applied.
+Valid options are:
+
+Localhost - a profile defined in a file on the node should be used.
+RuntimeDefault - the container runtime default profile should be used.
+Unconfined - no profile should be applied. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile defined in a file on the node should be used.
+The profile must be preconfigured on the node to work.
+Must be a descending path, relative to the kubelet's configured seccomp profile location.
+Must be set if type is "Localhost". Must NOT be set for any other type. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name of a property to set + |
+ true | +
| value | +string | +
+ Value of a property to set + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| gmsaCredentialSpec | +string | +
+ GMSACredentialSpec is where the GMSA admission webhook
+(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+GMSA credential spec named by the GMSACredentialSpecName field. + |
+ false | +
| gmsaCredentialSpecName | +string | +
+ GMSACredentialSpecName is the name of the GMSA credential spec to use. + |
+ false | +
| hostProcess | +boolean | +
+ HostProcess determines if a container should be run as a 'Host Process' container.
+All of a Pod's containers must have the same effective HostProcess value
+(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+In addition, if HostProcess is true then HostNetwork must also be set to true. + |
+ false | +
| runAsUserName | +string | +
+ The UserName in Windows to run the entrypoint of the container process.
+Defaults to the user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| port | +integer | +
+ The port that will be exposed by this service. + + Format: int32 + |
+ true | +
| appProtocol | +string | +
+ The application protocol for this port.
+This is used as a hint for implementations to offer richer behavior for protocols that they understand.
+This field follows standard Kubernetes label syntax.
+Valid values are either:
+
+* Un-prefixed protocol names - reserved for IANA standard service names (as per
+RFC-6335 and https://www.iana.org/assignments/service-names).
+
+* Kubernetes-defined prefixed names:
+ * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior-
+ * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455
+ * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455
+
+* Other protocols should use implementation-defined prefixed names such as
+mycompany.com/my-custom-protocol. + |
+ false | +
| hostPort | +integer | +
+ Allows defining which port to bind to the host in the Container. + + Format: int32 + |
+ false | +
| name | +string | +
+ The name of this port within the service. This must be a DNS_LABEL.
+All ports within a ServiceSpec must have unique names. When considering
+the endpoints for a Service, this must match the 'name' field in the
+EndpointPort.
+Optional if only one ServicePort is defined on this service. + |
+ false | +
| nodePort | +integer | +
+ The port on each node on which this service is exposed when type is
+NodePort or LoadBalancer. Usually assigned by the system. If a value is
+specified, in-range, and not in use it will be used, otherwise the
+operation will fail. If not specified, a port will be allocated if this
+Service requires one. If this field is specified when creating a
+Service which does not need it, creation will fail. This field will be
+wiped when updating a Service to no longer need it (e.g. changing type
+from NodePort to ClusterIP).
+More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + + Format: int32 + |
+ false | +
| protocol | +string | +
+ The IP protocol for this port. Supports "TCP", "UDP", and "SCTP".
+Default is TCP. + + Default: TCP + |
+ false | +
| targetPort | +int or string | +
+ Number or name of the port to access on the pods targeted by the service.
+Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
+If this is a string, it will be looked up as a named port in the
+target Pod's container ports. If this is not specified, the value
+of the 'port' field is used (an identity map).
+This field is ignored for services with clusterIP=None, and should be
+omitted or set equal to the 'port' field.
+More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| enabled | +boolean | +
+ Enabled indicates whether to use a PrometheusOperator custom resources as targets or not. + |
+ false | +
| podMonitorSelector | +object | +
+ PodMonitors to be selected for target discovery.
+A label selector is a label query over a set of resources. The result of matchLabels and
+matchExpressions are ANDed. An empty label selector matches all objects. A null
+label selector matches no objects. + |
+ false | +
| probeSelector | +object | +
+ Probes to be selected for target discovery.
+A label selector is a label query over a set of resources. The result of matchLabels and
+matchExpressions are ANDed. An empty label selector matches all objects. A null
+label selector matches no objects. + |
+ false | +
| scrapeConfigSelector | +object | +
+ ScrapeConfigs to be selected for target discovery.
+A label selector is a label query over a set of resources. The result of matchLabels and
+matchExpressions are ANDed. An empty label selector matches all objects. A null
+label selector matches no objects. + |
+ false | +
| scrapeInterval | +string | +
+ Default interval between consecutive scrapes. Intervals set in ServiceMonitors and PodMonitors override it.
+Equivalent to the same setting on the Prometheus CR.
+
+Default: "30s" + + Format: duration + Default: 30s + |
+ false | +
| serviceMonitorSelector | +object | +
+ ServiceMonitors to be selected for target discovery.
+A label selector is a label query over a set of resources. The result of matchLabels and
+matchExpressions are ANDed. An empty label selector matches all objects. A null
+label selector matches no objects. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| claims | +[]object | +
+ Claims lists the names of resources, defined in spec.resourceClaims,
+that are used by this container.
+
+This is an alpha field and requires enabling the
+DynamicResourceAllocation feature gate.
+
+This field is immutable. It can only be set for containers. + |
+ false | +
| limits | +map[string]int or string | +
+ Limits describes the maximum amount of compute resources allowed.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| requests | +map[string]int or string | +
+ Requests describes the minimum amount of compute resources required.
+If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+otherwise to an implementation-defined value. Requests cannot exceed Limits.
+More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name must match the name of one entry in pod.spec.resourceClaims of
+the Pod where this field is used. It makes that resource available
+inside a container. + |
+ true | +
| request | +string | +
+ Request is the name chosen for a request in the referenced claim.
+If empty, everything from the claim is made available, otherwise
+only the result of this request. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| allowPrivilegeEscalation | +boolean | +
+ AllowPrivilegeEscalation controls whether a process can gain more
+privileges than its parent process. This bool directly controls if
+the no_new_privs flag will be set on the container process.
+AllowPrivilegeEscalation is true always when the container is:
+1) run as Privileged
+2) has CAP_SYS_ADMIN
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| appArmorProfile | +object | +
+ appArmorProfile is the AppArmor options to use by this container. If set, this profile
+overrides the pod's appArmorProfile.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| capabilities | +object | +
+ The capabilities to add/drop when running containers.
+Defaults to the default set of capabilities granted by the container runtime.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| privileged | +boolean | +
+ Run container in privileged mode.
+Processes in privileged containers are essentially equivalent to root on the host.
+Defaults to false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| procMount | +string | +
+ procMount denotes the type of proc mount to use for the containers.
+The default value is Default which uses the container runtime defaults for
+readonly paths and masked paths.
+This requires the ProcMountType feature flag to be enabled.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| readOnlyRootFilesystem | +boolean | +
+ Whether this container has a read-only root filesystem.
+Default is false.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| runAsGroup | +integer | +
+ The GID to run the entrypoint of the container process.
+Uses runtime default if unset.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| runAsNonRoot | +boolean | +
+ Indicates that the container must run as a non-root user.
+If true, the Kubelet will validate the image at runtime to ensure that it
+does not run as UID 0 (root) and fail to start the container if it does.
+If unset or false, no such validation will be performed.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| runAsUser | +integer | +
+ The UID to run the entrypoint of the container process.
+Defaults to user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + + Format: int64 + |
+ false | +
| seLinuxOptions | +object | +
+ The SELinux context to be applied to the container.
+If unspecified, the container runtime will allocate a random SELinux context for each
+container. May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| seccompProfile | +object | +
+ The seccomp options to use by this container. If seccomp options are
+provided at both the pod & container level, the container options
+override the pod options.
+Note that this field cannot be set when spec.os.name is windows. + |
+ false | +
| windowsOptions | +object | +
+ The Windows specific settings applied to all containers.
+If unspecified, the options from the PodSecurityContext will be used.
+If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+Note that this field cannot be set when spec.os.name is linux. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of AppArmor profile will be applied.
+Valid options are:
+ Localhost - a profile pre-loaded on the node.
+ RuntimeDefault - the container runtime's default profile.
+ Unconfined - no AppArmor enforcement. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile loaded on the node that should be used.
+The profile must be preconfigured on the node to work.
+Must match the loaded name of the profile.
+Must be set if and only if type is "Localhost". + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| add | +[]string | +
+ Added capabilities + |
+ false | +
| drop | +[]string | +
+ Removed capabilities + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| level | +string | +
+ Level is SELinux level label that applies to the container. + |
+ false | +
| role | +string | +
+ Role is a SELinux role label that applies to the container. + |
+ false | +
| type | +string | +
+ Type is a SELinux type label that applies to the container. + |
+ false | +
| user | +string | +
+ User is a SELinux user label that applies to the container. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| type | +string | +
+ type indicates which kind of seccomp profile will be applied.
+Valid options are:
+
+Localhost - a profile defined in a file on the node should be used.
+RuntimeDefault - the container runtime default profile should be used.
+Unconfined - no profile should be applied. + |
+ true | +
| localhostProfile | +string | +
+ localhostProfile indicates a profile defined in a file on the node should be used.
+The profile must be preconfigured on the node to work.
+Must be a descending path, relative to the kubelet's configured seccomp profile location.
+Must be set if type is "Localhost". Must NOT be set for any other type. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| gmsaCredentialSpec | +string | +
+ GMSACredentialSpec is where the GMSA admission webhook
+(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
+GMSA credential spec named by the GMSACredentialSpecName field. + |
+ false | +
| gmsaCredentialSpecName | +string | +
+ GMSACredentialSpecName is the name of the GMSA credential spec to use. + |
+ false | +
| hostProcess | +boolean | +
+ HostProcess determines if a container should be run as a 'Host Process' container.
+All of a Pod's containers must have the same effective HostProcess value
+(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).
+In addition, if HostProcess is true then HostNetwork must also be set to true. + |
+ false | +
| runAsUserName | +string | +
+ The UserName in Windows to run the entrypoint of the container process.
+Defaults to the user specified in image metadata if unspecified.
+May also be set in PodSecurityContext. If set in both SecurityContext and
+PodSecurityContext, the value specified in SecurityContext takes precedence. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| effect | +string | +
+ Effect indicates the taint effect to match. Empty means match all taint effects.
+When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + |
+ false | +
| key | +string | +
+ Key is the taint key that the toleration applies to. Empty means match all taint keys.
+If the key is empty, operator must be Exists; this combination means to match all values and all keys. + |
+ false | +
| operator | +string | +
+ Operator represents a key's relationship to the value.
+Valid operators are Exists and Equal. Defaults to Equal.
+Exists is equivalent to wildcard for value, so that a pod can
+tolerate all taints of a particular category. + |
+ false | +
| tolerationSeconds | +integer | +
+ TolerationSeconds represents the period of time the toleration (which must be
+of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+it is not set, which means tolerate the taint forever (do not evict). Zero and
+negative values will be treated as 0 (evict immediately) by the system. + + Format: int64 + |
+ false | +
| value | +string | +
+ Value is the taint value the toleration matches to.
+If the operator is Exists, the value should be empty, otherwise just a regular string. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| maxSkew | +integer | +
+ MaxSkew describes the degree to which pods may be unevenly distributed.
+When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference
+between the number of matching pods in the target topology and the global minimum.
+The global minimum is the minimum number of matching pods in an eligible domain
+or zero if the number of eligible domains is less than MinDomains.
+For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+labelSelector spread as 2/2/1:
+In this case, the global minimum is 1.
+| zone1 | zone2 | zone3 |
+| P P | P P | P |
+- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;
+scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
+violate MaxSkew(1).
+- if MaxSkew is 2, incoming pod can be scheduled onto any zone.
+When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
+to topologies that satisfy it.
+It's a required field. Default value is 1 and 0 is not allowed. + + Format: int32 + |
+ true | +
| topologyKey | +string | +
+ TopologyKey is the key of node labels. Nodes that have a label with this key
+and identical values are considered to be in the same topology.
+We consider each + |
+ true | +
| whenUnsatisfiable | +string | +
+ WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy
+the spread constraint.
+- DoNotSchedule (default) tells the scheduler not to schedule it.
+- ScheduleAnyway tells the scheduler to schedule the pod in any location,
+ but giving higher precedence to topologies that would help reduce the
+ skew.
+A constraint is considered "Unsatisfiable" for an incoming pod
+if and only if every possible node assignment for that pod would violate
+"MaxSkew" on some topology.
+For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same
+labelSelector spread as 3/1/1:
+| zone1 | zone2 | zone3 |
+| P P P | P | P |
+If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled
+to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies
+MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
+won't make it *more* imbalanced.
+It's a required field. + |
+ true | +
| labelSelector | +object | +
+ LabelSelector is used to find matching pods.
+Pods that match this label selector are counted to determine the number of pods
+in their corresponding topology domain. + |
+ false | +
| matchLabelKeys | +[]string | +
+ MatchLabelKeys is a set of pod label keys to select the pods over which
+spreading will be calculated. The keys are used to lookup values from the
+incoming pod labels, those key-value labels are ANDed with labelSelector
+to select the group of existing pods over which spreading will be calculated
+for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.
+MatchLabelKeys cannot be set when LabelSelector isn't set.
+Keys that don't exist in the incoming pod labels will
+be ignored. A null or empty list means only match against labelSelector.
+
+This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + |
+ false | +
| minDomains | +integer | +
+ MinDomains indicates a minimum number of eligible domains.
+When the number of eligible domains with matching topology keys is less than minDomains,
+Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed.
+And when the number of eligible domains with matching topology keys equals or greater than minDomains,
+this value has no effect on scheduling.
+As a result, when the number of eligible domains is less than minDomains,
+scheduler won't schedule more than maxSkew Pods to those domains.
+If value is nil, the constraint behaves as if MinDomains is equal to 1.
+Valid values are integers greater than 0.
+When value is not nil, WhenUnsatisfiable must be DoNotSchedule.
+
+For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same
+labelSelector spread as 2/2/2:
+| zone1 | zone2 | zone3 |
+| P P | P P | P P |
+The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0.
+In this situation, new pod with the same labelSelector cannot be scheduled,
+because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,
+it will violate MaxSkew. + + Format: int32 + |
+ false | +
| nodeAffinityPolicy | +string | +
+ NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector
+when calculating pod topology spread skew. Options are:
+- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.
+- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
+
+If this value is nil, the behavior is equivalent to the Honor policy.
+This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + |
+ false | +
| nodeTaintsPolicy | +string | +
+ NodeTaintsPolicy indicates how we will treat node taints when calculating
+pod topology spread skew. Options are:
+- Honor: nodes without taints, along with tainted nodes for which the incoming pod
+has a toleration, are included.
+- Ignore: node taints are ignored. All nodes are included.
+
+If this value is nil, the behavior is equivalent to the Ignore policy.
+This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| matchExpressions | +[]object | +
+ matchExpressions is a list of label selector requirements. The requirements are ANDed. + |
+ false | +
| matchLabels | +map[string]string | +
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+map is equivalent to an element of matchExpressions, whose key field is "key", the
+operator is "In", and the values array contains only "value". The requirements are ANDed. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| key | +string | +
+ key is the label key that the selector applies to. + |
+ true | +
| operator | +string | +
+ operator represents a key's relationship to a set of values.
+Valid operators are In, NotIn, Exists and DoesNotExist. + |
+ true | +
| values | +[]string | +
+ values is an array of string values. If the operator is In or NotIn,
+the values array must be non-empty. If the operator is Exists or DoesNotExist,
+the values array must be empty. This array is replaced during a strategic
+merge patch. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| mountPath | +string | +
+ Path within the container at which the volume should be mounted. Must
+not contain ':'. + |
+ true | +
| name | +string | +
+ This must match the Name of a Volume. + |
+ true | +
| mountPropagation | +string | +
+ mountPropagation determines how mounts are propagated from the host
+to container and the other way around.
+When not set, MountPropagationNone is used.
+This field is beta in 1.10.
+When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+(which defaults to None). + |
+ false | +
| readOnly | +boolean | +
+ Mounted read-only if true, read-write otherwise (false or unspecified).
+Defaults to false. + |
+ false | +
| recursiveReadOnly | +string | +
+ RecursiveReadOnly specifies whether read-only mounts should be handled
+recursively.
+
+If ReadOnly is false, this field has no meaning and must be unspecified.
+
+If ReadOnly is true, and this field is set to Disabled, the mount is not made
+recursively read-only. If this field is set to IfPossible, the mount is made
+recursively read-only, if it is supported by the container runtime. If this
+field is set to Enabled, the mount is made recursively read-only if it is
+supported by the container runtime, otherwise the pod will not be started and
+an error will be generated to indicate the reason.
+
+If this field is set to IfPossible or Enabled, MountPropagation must be set to
+None (or be unspecified, which defaults to None).
+
+If this field is not specified, it is treated as an equivalent of Disabled. + |
+ false | +
| subPath | +string | +
+ Path within the volume from which the container's volume should be mounted.
+Defaults to "" (volume's root). + |
+ false | +
| subPathExpr | +string | +
+ Expanded path within the volume from which the container's volume should be mounted.
+Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+Defaults to "" (volume's root).
+SubPathExpr and SubPath are mutually exclusive. + |
+ false | +
| Name | +Type | +Description | +Required | +|
|---|---|---|---|---|
| name | +string | +
+ name of the volume.
+Must be a DNS_LABEL and unique within the pod.
+More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + |
+ true | +|
| awsElasticBlockStore | +object | +
+ awsElasticBlockStore represents an AWS Disk resource that is attached to a
+kubelet's host machine and then exposed to the pod.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + |
+ false | +|
| azureDisk | +object | +
+ azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod. + |
+ false | +|
| azureFile | +object | +
+ azureFile represents an Azure File Service mount on the host and bind mount to the pod. + |
+ false | +|
| cephfs | +object | +
+ cephFS represents a Ceph FS mount on the host that shares a pod's lifetime + |
+ false | +|
| cinder | +object | +
+ cinder represents a cinder volume attached and mounted on kubelets host machine.
+More info: https://examples.k8s.io/mysql-cinder-pd/README.md + |
+ false | +|
| configMap | +object | +
+ configMap represents a configMap that should populate this volume + |
+ false | +|
| csi | +object | +
+ csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers (Beta feature). + |
+ false | +|
| downwardAPI | +object | +
+ downwardAPI represents downward API about the pod that should populate this volume + |
+ false | +|
| emptyDir | +object | +
+ emptyDir represents a temporary directory that shares a pod's lifetime.
+More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + |
+ false | +|
| ephemeral | +object | +
+ ephemeral represents a volume that is handled by a cluster storage driver.
+The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
+and deleted when the pod is removed.
+
+Use this if:
+a) the volume is only needed while the pod runs,
+b) features of normal volumes like restoring from snapshot or capacity
+ tracking are needed,
+c) the storage driver is specified through a storage class, and
+d) the storage driver supports dynamic volume provisioning through
+ a PersistentVolumeClaim (see EphemeralVolumeSource for more
+ information on the connection between this volume type
+ and PersistentVolumeClaim).
+
+Use PersistentVolumeClaim or one of the vendor-specific
+APIs for volumes that persist for longer than the lifecycle
+of an individual pod.
+
+Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
+be used that way - see the documentation of the driver for
+more information.
+
+A pod can use both types of ephemeral volumes and
+persistent volumes at the same time. + |
+ false | +|
| fc | object |
fc represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod. |
false | |
| flexVolume | +flexVolume | object |
flexVolume represents a generic volume resource that is
@@ -30535,14 +45073,14 @@ provisioned/attached using an exec based plugin. |
false |
| flocker | +flocker | object |
flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running |
false |
| gcePersistentDisk | +gcePersistentDisk | object | gcePersistentDisk represents a GCE Disk resource that is attached to a @@ -30551,7 +45089,7 @@ More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk | false |
| gitRepo | +gitRepo | object |
gitRepo represents a git repository at a particular revision.
@@ -30561,7 +45099,7 @@ into the Pod's container. |
false |
| glusterfs | +glusterfs | object |
glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
@@ -30569,7 +45107,7 @@ More info: https://examples.k8s.io/volumes/glusterfs/README.md |
false |
| hostPath | +hostPath | object |
hostPath represents a pre-existing file or directory on the host
@@ -30580,7 +45118,7 @@ More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath |
false |
| image | +image | object | image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine. @@ -30595,7 +45133,7 @@ A failure to resolve or pull the image during pod startup will block containers | false |
| iscsi | +iscsi | object |
iscsi represents an ISCSI Disk resource that is attached to a
@@ -30604,7 +45142,7 @@ More info: https://examples.k8s.io/volumes/iscsi/README.md |
false |
| nfs | +nfs | object |
nfs represents an NFS mount on the host that shares a pod's lifetime
@@ -30612,7 +45150,7 @@ More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs |
false |
| persistentVolumeClaim | +persistentVolumeClaim | object | persistentVolumeClaimVolumeSource represents a reference to a @@ -30621,35 +45159,35 @@ More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persis | false |
| photonPersistentDisk | +photonPersistentDisk | object |
photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine |
false |
| portworxVolume | +portworxVolume | object |
portworxVolume represents a portworx volume attached and mounted on kubelets host machine |
false |
| projected | +projected | object |
projected items for all in one resources secrets, configmaps, and downward API |
false |
| quobyte | +quobyte | object |
quobyte represents a Quobyte mount on the host that shares a pod's lifetime |
false |
| rbd | +rbd | object |
rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
@@ -30657,14 +45195,14 @@ More info: https://examples.k8s.io/volumes/rbd/README.md |
false |
| scaleIO | +scaleIO | object |
scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes. |
false |
| secret | +secret | object |
secret represents a secret that should populate this volume.
@@ -30672,14 +45210,14 @@ More info: https://kubernetes.io/docs/concepts/storage/volumes#secret |
false |
| storageos | +storageos | object |
storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes. |
false |
| vsphereVolume | +vsphereVolume | object |
vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine @@ -30689,8 +45227,8 @@ More info: https://kubernetes.io/docs/concepts/storage/volumes#secret |
| image | string |
- Image indicates the container image to use for the OpenTelemetry Collector. - |
- false | -
| messages | -[]string | -
- Messages about actions performed by the operator on this resource.
-Deprecated: use Kubernetes events instead. - |
- false | -
| replicas | -integer | -
- Replicas is currently not being set and might be removed in the next version.
-Deprecated: use "OpenTelemetryCollector.Status.Scale.Replicas" instead. - - Format: int32 - |
- false | -
| scale | -object | -
- Scale is the OpenTelemetryCollector's scale subresource status. + Image indicates the container image to use for the Target Allocator. |
false |
| version | string |
- Version of the managed OpenTelemetry Collector (operand) - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| replicas | -integer | -
- The total number non-terminated pods targeted by this
-OpenTelemetryCollector's deployment or statefulSet. - - Format: int32 - |
- false | -
| selector | -string | -
- The selector used to match the OpenTelemetryCollector's
-deployment or statefulSet pods. - |
- false | -
| statusReplicas | -string | -
- StatusReplicas is the number of pods targeted by this OpenTelemetryCollector's with a Ready Condition /
-Total number of non-terminated pods targeted by this OpenTelemetryCollector's (their labels match the selector).
-Deployment, Daemonset, StatefulSet. + Version of the managed Target Allocator (operand) |
false |