ClusterBundle
trust-manager.io / v1alpha2
apiVersion: trust-manager.io/v1alpha2
kind: ClusterBundle
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
spec represents the desired state of the ClusterBundle resource.
defaultCAs object
defaultCAs configures the use of a default CA bundle as a trust source.
provider
string required
provider identifies the provider of the default CA bundle.
Valid values:
- System: Uses the default CA package made available to trust-manager at startup.
The default CA bundle is available only if trust-manager was installed with
default CA support enabled, either via the Helm chart or by starting the
trust-manager controller with the "--default-package-location" flag.
If no default CA package was configured at startup, specifying this source
will result in reconciliation failure.
The version of the default CA package used for this Bundle is reported in
status.defaultCAVersion.
- Disabled: No default CAs are used as sources.
enum:
System, Disabled
inLineCAs
string
inLineCAs is a simple string to append as the source data.
minLength:
1maxLength:
1048576sourceRefs []object
sourceRefs is a list of references to resources whose data will be appended and synced into
the bundle target resources.
minItems:
0maxItems:
100
key
string required
key specifies one or more keys in the object's data field to be used.
The "*" wildcard matches any sequence of characters within a key.
A value of "*" matches all entries in the data field.
pattern:
^[0-9A-Za-z_.\-*]+$minLength:
1maxLength:
253
kind
string required
kind is the kind of the source object.
enum:
ConfigMap, Secret
name
string
name is the name of the source object in the trust namespace.
This field must be left empty when `selector` is set
minLength:
1maxLength:
253selector object
selector is the label selector to use to fetch a list of objects. Must not be set
when `name` is set.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
target object
target is the target location in all namespaces to sync source data to.
configMap object
configMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.
data []object required
data is the specification of the object's `data` field.
minItems:
1maxItems:
10
format
string
format defines the format of the target value.
The default format is PEM.
enum:
PEM, PKCS12
key
string required
key is the key of the entry in the object's `data` field to be used.
pattern:
^[0-9A-Za-z_.\-]+$minLength:
1maxLength:
253
password
string
password for PKCS12 trust store.
By default, no password is used (password-less PKCS#12).
minLength:
0maxLength:
128
profile
string
profile specifies the certificate encryption algorithms and the HMAC algorithm
used to create the PKCS12 trust store.
If provided, allowed values are:
`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g. because of company policy).
Default value is `LegacyDES`.
enum:
LegacyRC2, LegacyDES, Modern2023metadata object
metadata is an optional set of labels and annotations to be copied to the target.
annotations
object
annotations is a key value map to be copied to the target.
labels
object
labels is a key value map to be copied to the target.
namespaceSelector object required
namespaceSelector specifies the namespaces where target resources will be synced.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
secret object
secret is the target Secret in Namespaces that all Bundle source data will be synced to.
Using Secrets as targets is only supported if enabled at trust-manager startup.
By default, trust-manager has no permissions for writing to secrets and can only read secrets in the trust namespace.
data []object required
data is the specification of the object's `data` field.
minItems:
1maxItems:
10
format
string
format defines the format of the target value.
The default format is PEM.
enum:
PEM, PKCS12
key
string required
key is the key of the entry in the object's `data` field to be used.
pattern:
^[0-9A-Za-z_.\-]+$minLength:
1maxLength:
253
password
string
password for PKCS12 trust store.
By default, no password is used (password-less PKCS#12).
minLength:
0maxLength:
128
profile
string
profile specifies the certificate encryption algorithms and the HMAC algorithm
used to create the PKCS12 trust store.
If provided, allowed values are:
`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms (e.g. because of company policy).
Default value is `LegacyDES`.
enum:
LegacyRC2, LegacyDES, Modern2023metadata object
metadata is an optional set of labels and annotations to be copied to the target.
annotations
object
annotations is a key value map to be copied to the target.
labels
object
labels is a key value map to be copied to the target.
status object
status of the ClusterBundle. This is set and managed automatically.
conditions []object
conditions represent the latest available observations of the ClusterBundle's current state.
minItems:
0maxItems:
10
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
defaultCAVersion
string
defaultCAVersion is the version of the default CA package used for this ClusterBundle
when resolving default CAs, if applicable.
This field is populated only when default CAs are configured via spec.defaultCAs.
ClusterBundles resolved from identical sets of default CA certificates will report
the same defaultCAVersion value.
minLength:
1maxLength:
253No matches. Try .spec.defaultCAs for an exact path