diff --git a/charts/tekton-operator/templates/kubernetes-crds.yaml b/charts/tekton-operator/templates/kubernetes-crds.yaml index 59d3f42313..5b9c28ea07 100644 --- a/charts/tekton-operator/templates/kubernetes-crds.yaml +++ b/charts/tekton-operator/templates/kubernetes-crds.yaml @@ -2913,9 +2913,10 @@ spec: networkPolicy: description: |- NetworkPolicy configures NetworkPolicy resources for the operand namespace. - This field is propagated to TektonTrigger, TektonPipeline, TektonChain, - and TektonPruner, which are the components with NetworkPolicy reconciliation - implemented. Other components (Results, Dashboard) do not yet act on this field. + This field is propagated to TektonPipeline, TektonTrigger, TektonChain, + TektonPruner, TektonResult, Pipelines-as-Code, and MultiCluster components + (TektonScheduler, TektonMulticlusterProxyAAE, SyncerService). + Other components (Dashboard) do not yet act on this field. properties: disabled: description: |- @@ -5816,357 +5817,19 @@ spec: type: string loki_stack_namespace: type: string - options: - description: Options holds additions fields and these fields will - be updated on the manifests + networkPolicy: + description: NetworkPolicy configures NetworkPolicy creation for TektonResult + workloads. properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + policies: additionalProperties: - description: WebhookOptions defines options for webhooks - properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. - type: string - timeoutSeconds: - type: integer - type: object - type: object - type: object - performance: - description: |- - PerformanceProperties defines the fields which are configurable - to tune the performance of component controller - properties: - buckets: - type: integer - disable-ha: - description: if it is true, disables the HA feature - type: boolean - kube-api-burst: - type: integer - kube-api-qps: - description: |- - queries per second (QPS) and burst to the master from rest API client - actually the number multiplied by 2 - https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 - defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 - type: number - replicas: - type: integer - statefulset-ordinals: - description: if is true, enable StatefulsetOrdinals mode - type: boolean - threads-per-controller: - description: The number of workers to use when processing the - component controller's work queue - type: integer - required: - - disable-ha - type: object - prometheus_histogram: - type: boolean - prometheus_port: - type: integer - route_enabled: - description: Route configuration for Results API service exposure - type: boolean - route_host: - type: string - route_path: - type: string - route_tls_termination: - type: string - secret_name: - description: |- - name of the secret used to get S3 credentials and - pass it as environment variables to the "tekton-results-api" deployment under "api" container - type: string - server_port: - type: integer - storage_emulator_host: - type: string - targetNamespace: - description: TargetNamespace is where resources will be installed - type: string - tls_hostname_override: - type: string - watcher: - description: Watcher holds configuration for the Tekton Results Watcher - controller. - properties: - check_owner: - description: |- - When true, resources with owner references are not deleted after the grace - period. When false, owner references are ignored for deletion. - type: boolean - completed_run_grace_period: - description: |- - Grace period before completed TaskRuns/PipelineRuns are deleted from the - cluster after being stored in Results. 0 disables deletion. Negative - values delete immediately after completion. - type: string - disable_crd_update: - description: Disable updating Tekton CRD annotations during reconcile. - type: boolean - disable_storing_incomplete_runs: - description: |- - When true, only store Runs after they complete. When false, store Runs on - every update throughout their lifecycle. - type: boolean - dynamic_reconcile_timeout: - description: Timeout for the dynamic reconciler to process an - event. - type: string - forward_buffer: - description: Duration to wait for log forwarder to finish after - TaskRun completion. - type: string - label_selector: - description: Label selector for Runs eligible for deletion after - the grace period. - type: string - logs_api: - description: Enable sending TaskRun/PipelineRun logs to the Results - API. - type: boolean - logs_timestamps: - description: Collect logs with timestamps. - type: boolean - requeue_interval: - description: How long the Watcher waits before reprocessing keys - on certain events. - type: string - store_deadline: - description: |- - Maximum time to wait for a Run to be stored before clearing the finalizer - during deletion. - type: string - store_event: - description: Store Kubernetes events related to TaskRuns and PipelineRuns. - type: boolean - summary_annotations: - description: Comma-separated annotation keys copied into the Result - summary. - type: string - summary_labels: - description: Comma-separated label keys copied into the Result - summary. - type: string - update_log_timeout: - description: Timeout for storing logs before aborting. - type: string - type: object - required: - - disabled - - is_external_db - type: object - status: - description: TektonResultStatus defines the observed state of TektonResult - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - conditions: - description: Conditions the latest available observations of a resource's - current state. - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about - the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - required: - - status - - type - type: object - type: array - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - tektonInstallerSet: - description: The current installer set name for TektonResult - type: string - version: - description: The version of the installed release - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.18.0 - name: tektontriggers.operator.tekton.dev - labels: - version: "devel" - operator.tekton.dev/release: "devel" -spec: - group: operator.tekton.dev - names: - kind: TektonTrigger - listKind: TektonTriggerList - plural: tektontriggers - singular: tektontrigger - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.version - name: Version - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Reason - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: TektonTrigger is the Schema for the tektontriggers API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: TektonTriggerSpec defines the desired state of TektonTrigger - properties: - config: - description: Config holds the configuration for resources created - by TektonTrigger - properties: - nodeSelector: - additionalProperties: - type: string - type: object - priorityClassName: - description: PriorityClassName holds the priority class to be - set to pod template - type: string - tolerations: - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - type: object - default-service-account: - type: string - disabled: - description: enable or disable Trigger Component - type: boolean - enable-api-fields: - type: string - networkPolicy: - description: NetworkPolicy configures NetworkPolicy creation for TektonTrigger - workloads. - properties: - disabled: - description: |- - Disabled disables all NetworkPolicy creation for this component. - Existing policies are removed on the next reconcile. - type: boolean - policies: - additionalProperties: - description: NetworkPolicySpec provides the specification of - a NetworkPolicy + description: NetworkPolicySpec provides the specification of + a NetworkPolicy properties: egress: description: |- @@ -6642,7 +6305,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object options: - description: options holds additions fields and these fields will + description: Options holds additions fields and these fields will be updated on the manifests properties: configMaps: @@ -6673,14 +6336,136 @@ spec: type: object type: object type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the + component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + type: integer + storage_emulator_host: + type: string targetNamespace: description: TargetNamespace is where resources will be installed type: string + tls_hostname_override: + type: string + watcher: + description: Watcher holds configuration for the Tekton Results Watcher + controller. + properties: + check_owner: + description: |- + When true, resources with owner references are not deleted after the grace + period. When false, owner references are ignored for deletion. + type: boolean + completed_run_grace_period: + description: |- + Grace period before completed TaskRuns/PipelineRuns are deleted from the + cluster after being stored in Results. 0 disables deletion. Negative + values delete immediately after completion. + type: string + disable_crd_update: + description: Disable updating Tekton CRD annotations during reconcile. + type: boolean + disable_storing_incomplete_runs: + description: |- + When true, only store Runs after they complete. When false, store Runs on + every update throughout their lifecycle. + type: boolean + dynamic_reconcile_timeout: + description: Timeout for the dynamic reconciler to process an + event. + type: string + forward_buffer: + description: Duration to wait for log forwarder to finish after + TaskRun completion. + type: string + label_selector: + description: Label selector for Runs eligible for deletion after + the grace period. + type: string + logs_api: + description: Enable sending TaskRun/PipelineRun logs to the Results + API. + type: boolean + logs_timestamps: + description: Collect logs with timestamps. + type: boolean + requeue_interval: + description: How long the Watcher waits before reprocessing keys + on certain events. + type: string + store_deadline: + description: |- + Maximum time to wait for a Run to be stored before clearing the finalizer + during deletion. + type: string + store_event: + description: Store Kubernetes events related to TaskRuns and PipelineRuns. + type: boolean + summary_annotations: + description: Comma-separated annotation keys copied into the Result + summary. + type: string + summary_labels: + description: Comma-separated label keys copied into the Result + summary. + type: string + update_log_timeout: + description: Timeout for storing logs before aborting. + type: string + type: object required: - disabled + - is_external_db type: object status: - description: TektonTriggerStatus defines the observed state of TektonTrigger + description: TektonResultStatus defines the observed state of TektonResult properties: annotations: additionalProperties: @@ -6734,7 +6519,7 @@ spec: was last processed by the controller. type: integer tektonInstallerSet: - description: The current installer set name + description: The current installer set name for TektonResult type: string version: description: The version of the installed release @@ -6751,17 +6536,17 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonpruners.operator.tekton.dev + name: tektontriggers.operator.tekton.dev labels: version: "devel" operator.tekton.dev/release: "devel" spec: group: operator.tekton.dev names: - kind: TektonPruner - listKind: TektonPrunerList - plural: tektonpruners - singular: tektonpruner + kind: TektonTrigger + listKind: TektonTriggerList + plural: tektontriggers + singular: tektontrigger scope: Cluster versions: - additionalPrinterColumns: @@ -6777,7 +6562,7 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: TektonPruner is the Schema for the TektonPruner API + description: TektonTrigger is the Schema for the tektontriggers API properties: apiVersion: description: |- @@ -6797,10 +6582,11 @@ spec: metadata: type: object spec: + description: TektonTriggerSpec defines the desired state of TektonTrigger properties: config: description: Config holds the configuration for resources created - by TektonPruner + by TektonTrigger properties: nodeSelector: additionalProperties: @@ -6849,136 +6635,16 @@ spec: type: object type: array type: object + default-service-account: + type: string disabled: - description: enable or disable TektonPruner Component + description: enable or disable Trigger Component type: boolean - global-config: - description: |- - GlobalConfig represents the global ConfigMap (tekton-pruner-default-spec) - Root-level fields are defaults; Namespaces map is for per-namespace defaults - NOTE: Selector support (PipelineRuns/TaskRuns arrays) is IGNORED in global ConfigMap - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: global, namespace - (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - namespaces: - additionalProperties: - description: |- - NamespaceSpec is used to hold the pruning config of a specific namespace and its resources - Used in both global ConfigMap (tekton-pruner-default-spec) and namespace ConfigMap (tekton-pruner-namespace-spec) - Selector support (PipelineRuns/TaskRuns arrays) ONLY works in namespace ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: global, - namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - pipelineRuns: - items: - description: |- - ResourceSpec is used to hold the config of a specific resource - Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: - global, namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - name: - type: string - selector: - items: - description: |- - SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun - Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps - properties: - matchAnnotations: - additionalProperties: - type: string - type: object - matchLabels: - additionalProperties: - type: string - description: Match by labels AND annotations. - If both are specified, BOTH must match (AND - logic) - type: object - type: object - type: array - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - type: array - successfulHistoryLimit: - type: integer - taskRuns: - items: - description: |- - ResourceSpec is used to hold the config of a specific resource - Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: - global, namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - name: - type: string - selector: - items: - description: |- - SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun - Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps - properties: - matchAnnotations: - additionalProperties: - type: string - type: object - matchLabels: - additionalProperties: - type: string - description: Match by labels AND annotations. - If both are specified, BOTH must match (AND - logic) - type: object - type: object - type: array - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - type: array - ttlSecondsAfterFinished: - type: integer - type: object - type: object - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - x-kubernetes-preserve-unknown-fields: true - networkPolicy: - description: |- - NetworkPolicy configures NetworkPolicy creation for the controller - and webhook workloads deployed by TektonPruner. + enable-api-fields: + type: string + networkPolicy: + description: NetworkPolicy configures NetworkPolicy creation for TektonTrigger + workloads. properties: disabled: description: |- @@ -7500,10 +7166,9 @@ spec: type: string required: - disabled - - global-config type: object status: - description: TektonPrunerStatus defines the observed state of TektonPruner + description: TektonTriggerStatus defines the observed state of TektonTrigger properties: annotations: additionalProperties: @@ -7557,7 +7222,7 @@ spec: was last processed by the controller. type: integer tektonInstallerSet: - description: The current installer set name for TektonPruner + description: The current installer set name type: string version: description: The version of the installed release @@ -7574,17 +7239,17 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonschedulers.operator.tekton.dev + name: tektonpruners.operator.tekton.dev labels: version: "devel" operator.tekton.dev/release: "devel" spec: group: operator.tekton.dev names: - kind: TektonScheduler - listKind: TektonSchedulerList - plural: tektonschedulers - singular: tektonscheduler + kind: TektonPruner + listKind: TektonPrunerList + plural: tektonpruners + singular: tektonpruner scope: Cluster versions: - additionalPrinterColumns: @@ -7600,7 +7265,7 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: TektonScheduler is the Schema for the TektonScheduler API + description: TektonPruner is the Schema for the TektonPruner API properties: apiVersion: description: |- @@ -7621,225 +7286,2022 @@ spec: type: object spec: properties: - config.yaml: - description: |- - This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to - match the key here + config: + description: Config holds the configuration for resources created + by TektonPruner properties: - cel: - properties: - expressions: - items: - type: string - type: array + nodeSelector: + additionalProperties: + type: string type: object - multiKueueOverride: - type: boolean - queueName: + priorityClassName: + description: PriorityClassName holds the priority class to be + set to pod template type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array type: object - x-kubernetes-preserve-unknown-fields: true disabled: - description: enable or disable TektonScheduler Component - type: boolean - multi-cluster-disabled: + description: enable or disable TektonPruner Component type: boolean - multi-cluster-role: + global-config: description: |- - MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole - can be one of Hub or Spoke - type: string - options: - description: options holds additions fields and these fields will - be updated on the manifests + GlobalConfig represents the global ConfigMap (tekton-pruner-default-spec) + Root-level fields are defaults; Namespaces map is for per-namespace defaults + NOTE: Selector support (PipelineRuns/TaskRuns arrays) is IGNORED in global ConfigMap properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true - disabled: - type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: global, namespace + (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + namespaces: additionalProperties: - description: WebhookOptions defines options for webhooks + description: |- + NamespaceSpec is used to hold the pruning config of a specific namespace and its resources + Used in both global ConfigMap (tekton-pruner-default-spec) and namespace ConfigMap (tekton-pruner-namespace-spec) + Selector support (PipelineRuns/TaskRuns arrays) ONLY works in namespace ConfigMaps properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: global, + namespace (default: namespace)' type: string - timeoutSeconds: + failedHistoryLimit: type: integer - type: object - type: object - type: object - targetNamespace: - description: TargetNamespace is where resources will be installed - type: string - required: - - config.yaml - - disabled - - multi-cluster-disabled - - multi-cluster-role - type: object - status: - description: TektonSchedulerStatus defines the observed state of TektonScheduler - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. + historyLimit: + type: integer + pipelineRuns: + items: + description: |- + ResourceSpec is used to hold the config of a specific resource + Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps + properties: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: + global, namespace (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + name: + type: string + selector: + items: + description: |- + SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun + Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps + properties: + matchAnnotations: + additionalProperties: + type: string + type: object + matchLabels: + additionalProperties: + type: string + description: Match by labels AND annotations. + If both are specified, BOTH must match (AND + logic) + type: object + type: object + type: array + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer + type: object + type: array + successfulHistoryLimit: + type: integer + taskRuns: + items: + description: |- + ResourceSpec is used to hold the config of a specific resource + Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps + properties: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: + global, namespace (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + name: + type: string + selector: + items: + description: |- + SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun + Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps + properties: + matchAnnotations: + additionalProperties: + type: string + type: object + matchLabels: + additionalProperties: + type: string + description: Match by labels AND annotations. + If both are specified, BOTH must match (AND + logic) + type: object + type: object + type: array + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer + type: object + type: array + ttlSecondsAfterFinished: + type: integer + type: object + type: object + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer type: object - conditions: - description: Conditions the latest available observations of a resource's - current state. - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about - the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - required: - - status - - type - type: object - type: array - observedGeneration: + x-kubernetes-preserve-unknown-fields: true + networkPolicy: description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - tekton-scheduler: - description: The current installer set name for TektonScheduler - type: string - version: - description: The version of the installed release - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonmulticlusterproxyaaes.operator.tekton.dev - labels: - version: "devel" - operator.tekton.dev/release: "devel" -spec: - group: operator.tekton.dev - names: - kind: TektonMulticlusterProxyAAE - listKind: TektonMulticlusterProxyAAEList - plural: tektonmulticlusterproxyaaes - singular: tektonmulticlusterproxyaae - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.version - name: Version - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Reason - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE - API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - options: - description: options holds additional fields and these fields will - be updated on the manifests + NetworkPolicy configures NetworkPolicy creation for the controller + and webhook workloads deployed by TektonPruner. properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + policies: additionalProperties: - description: WebhookOptions defines options for webhooks + description: NetworkPolicySpec provides the specification of + a NetworkPolicy properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. - type: string - timeoutSeconds: - type: integer - type: object + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additions fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - global-config + type: object + status: + description: TektonPrunerStatus defines the observed state of TektonPruner + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's + current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPruner + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + name: tektonschedulers.operator.tekton.dev + labels: + version: "devel" + operator.tekton.dev/release: "devel" +spec: + group: operator.tekton.dev + names: + kind: TektonScheduler + listKind: TektonSchedulerList + plural: tektonschedulers + singular: tektonscheduler + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonScheduler is the Schema for the TektonScheduler API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + properties: + cel: + properties: + expressions: + items: + type: string + type: array + type: object + multiKueueOverride: + type: boolean + queueName: + type: string + type: object + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additions fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + type: object + status: + description: TektonSchedulerStatus defines the observed state of TektonScheduler + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's + current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + tekton-scheduler: + description: The current installer set name for TektonScheduler + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + name: tektonmulticlusterproxyaaes.operator.tekton.dev + labels: + version: "devel" + operator.tekton.dev/release: "devel" +spec: + group: operator.tekton.dev + names: + kind: TektonMulticlusterProxyAAE + listKind: TektonMulticlusterProxyAAEList + plural: tektonmulticlusterproxyaaes + singular: tektonmulticlusterproxyaae + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additional fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object type: object type: object targetNamespace: @@ -8005,18 +9467,505 @@ spec: type: string tolerationSeconds: description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - type: integer - value: + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic type: object - type: array + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true type: object options: description: Options holds additions fields and these fields will diff --git a/charts/tekton-operator/templates/openshift-crds.yaml b/charts/tekton-operator/templates/openshift-crds.yaml index 539bc6f60b..1f2a8aaf32 100644 --- a/charts/tekton-operator/templates/openshift-crds.yaml +++ b/charts/tekton-operator/templates/openshift-crds.yaml @@ -3107,9 +3107,10 @@ spec: networkPolicy: description: |- NetworkPolicy configures NetworkPolicy resources for the operand namespace. - This field is propagated to TektonTrigger, TektonPipeline, TektonChain, - and TektonPruner, which are the components with NetworkPolicy reconciliation - implemented. Other components (Results, Dashboard) do not yet act on this field. + This field is propagated to TektonPipeline, TektonTrigger, TektonChain, + TektonPruner, TektonResult, Pipelines-as-Code, and MultiCluster components + (TektonScheduler, TektonMulticlusterProxyAAE, SyncerService). + Other components (Dashboard) do not yet act on this field. properties: disabled: description: |- @@ -5795,357 +5796,19 @@ spec: type: string loki_stack_namespace: type: string - options: - description: Options holds additions fields and these fields will - be updated on the manifests + networkPolicy: + description: NetworkPolicy configures NetworkPolicy creation for TektonResult + workloads. properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + policies: additionalProperties: - description: WebhookOptions defines options for webhooks - properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. - type: string - timeoutSeconds: - type: integer - type: object - type: object - type: object - performance: - description: |- - PerformanceProperties defines the fields which are configurable - to tune the performance of component controller - properties: - buckets: - type: integer - disable-ha: - description: if it is true, disables the HA feature - type: boolean - kube-api-burst: - type: integer - kube-api-qps: - description: |- - queries per second (QPS) and burst to the master from rest API client - actually the number multiplied by 2 - https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 - defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 - type: number - replicas: - type: integer - statefulset-ordinals: - description: if is true, enable StatefulsetOrdinals mode - type: boolean - threads-per-controller: - description: The number of workers to use when processing the - component controller's work queue - type: integer - required: - - disable-ha - type: object - prometheus_histogram: - type: boolean - prometheus_port: - type: integer - route_enabled: - description: Route configuration for Results API service exposure - type: boolean - route_host: - type: string - route_path: - type: string - route_tls_termination: - type: string - secret_name: - description: |- - name of the secret used to get S3 credentials and - pass it as environment variables to the "tekton-results-api" deployment under "api" container - type: string - server_port: - type: integer - storage_emulator_host: - type: string - targetNamespace: - description: TargetNamespace is where resources will be installed - type: string - tls_hostname_override: - type: string - watcher: - description: Watcher holds configuration for the Tekton Results Watcher - controller. - properties: - check_owner: - description: |- - When true, resources with owner references are not deleted after the grace - period. When false, owner references are ignored for deletion. - type: boolean - completed_run_grace_period: - description: |- - Grace period before completed TaskRuns/PipelineRuns are deleted from the - cluster after being stored in Results. 0 disables deletion. Negative - values delete immediately after completion. - type: string - disable_crd_update: - description: Disable updating Tekton CRD annotations during reconcile. - type: boolean - disable_storing_incomplete_runs: - description: |- - When true, only store Runs after they complete. When false, store Runs on - every update throughout their lifecycle. - type: boolean - dynamic_reconcile_timeout: - description: Timeout for the dynamic reconciler to process an - event. - type: string - forward_buffer: - description: Duration to wait for log forwarder to finish after - TaskRun completion. - type: string - label_selector: - description: Label selector for Runs eligible for deletion after - the grace period. - type: string - logs_api: - description: Enable sending TaskRun/PipelineRun logs to the Results - API. - type: boolean - logs_timestamps: - description: Collect logs with timestamps. - type: boolean - requeue_interval: - description: How long the Watcher waits before reprocessing keys - on certain events. - type: string - store_deadline: - description: |- - Maximum time to wait for a Run to be stored before clearing the finalizer - during deletion. - type: string - store_event: - description: Store Kubernetes events related to TaskRuns and PipelineRuns. - type: boolean - summary_annotations: - description: Comma-separated annotation keys copied into the Result - summary. - type: string - summary_labels: - description: Comma-separated label keys copied into the Result - summary. - type: string - update_log_timeout: - description: Timeout for storing logs before aborting. - type: string - type: object - required: - - disabled - - is_external_db - type: object - status: - description: TektonResultStatus defines the observed state of TektonResult - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - conditions: - description: Conditions the latest available observations of a resource's - current state. - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about - the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - required: - - status - - type - type: object - type: array - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - tektonInstallerSet: - description: The current installer set name for TektonResult - type: string - version: - description: The version of the installed release - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.18.0 - name: tektontriggers.operator.tekton.dev - labels: - version: "devel" - operator.tekton.dev/release: "devel" -spec: - group: operator.tekton.dev - names: - kind: TektonTrigger - listKind: TektonTriggerList - plural: tektontriggers - singular: tektontrigger - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.version - name: Version - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Reason - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: TektonTrigger is the Schema for the tektontriggers API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: TektonTriggerSpec defines the desired state of TektonTrigger - properties: - config: - description: Config holds the configuration for resources created - by TektonTrigger - properties: - nodeSelector: - additionalProperties: - type: string - type: object - priorityClassName: - description: PriorityClassName holds the priority class to be - set to pod template - type: string - tolerations: - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - type: object - default-service-account: - type: string - disabled: - description: enable or disable Trigger Component - type: boolean - enable-api-fields: - type: string - networkPolicy: - description: NetworkPolicy configures NetworkPolicy creation for TektonTrigger - workloads. - properties: - disabled: - description: |- - Disabled disables all NetworkPolicy creation for this component. - Existing policies are removed on the next reconcile. - type: boolean - policies: - additionalProperties: - description: NetworkPolicySpec provides the specification of - a NetworkPolicy + description: NetworkPolicySpec provides the specification of + a NetworkPolicy properties: egress: description: |- @@ -6621,7 +6284,7 @@ spec: x-kubernetes-preserve-unknown-fields: true type: object options: - description: options holds additions fields and these fields will + description: Options holds additions fields and these fields will be updated on the manifests properties: configMaps: @@ -6652,14 +6315,136 @@ spec: type: object type: object type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the + component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + type: integer + storage_emulator_host: + type: string targetNamespace: description: TargetNamespace is where resources will be installed type: string + tls_hostname_override: + type: string + watcher: + description: Watcher holds configuration for the Tekton Results Watcher + controller. + properties: + check_owner: + description: |- + When true, resources with owner references are not deleted after the grace + period. When false, owner references are ignored for deletion. + type: boolean + completed_run_grace_period: + description: |- + Grace period before completed TaskRuns/PipelineRuns are deleted from the + cluster after being stored in Results. 0 disables deletion. Negative + values delete immediately after completion. + type: string + disable_crd_update: + description: Disable updating Tekton CRD annotations during reconcile. + type: boolean + disable_storing_incomplete_runs: + description: |- + When true, only store Runs after they complete. When false, store Runs on + every update throughout their lifecycle. + type: boolean + dynamic_reconcile_timeout: + description: Timeout for the dynamic reconciler to process an + event. + type: string + forward_buffer: + description: Duration to wait for log forwarder to finish after + TaskRun completion. + type: string + label_selector: + description: Label selector for Runs eligible for deletion after + the grace period. + type: string + logs_api: + description: Enable sending TaskRun/PipelineRun logs to the Results + API. + type: boolean + logs_timestamps: + description: Collect logs with timestamps. + type: boolean + requeue_interval: + description: How long the Watcher waits before reprocessing keys + on certain events. + type: string + store_deadline: + description: |- + Maximum time to wait for a Run to be stored before clearing the finalizer + during deletion. + type: string + store_event: + description: Store Kubernetes events related to TaskRuns and PipelineRuns. + type: boolean + summary_annotations: + description: Comma-separated annotation keys copied into the Result + summary. + type: string + summary_labels: + description: Comma-separated label keys copied into the Result + summary. + type: string + update_log_timeout: + description: Timeout for storing logs before aborting. + type: string + type: object required: - disabled + - is_external_db type: object status: - description: TektonTriggerStatus defines the observed state of TektonTrigger + description: TektonResultStatus defines the observed state of TektonResult properties: annotations: additionalProperties: @@ -6713,7 +6498,7 @@ spec: was last processed by the controller. type: integer tektonInstallerSet: - description: The current installer set name + description: The current installer set name for TektonResult type: string version: description: The version of the installed release @@ -6730,17 +6515,17 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonpruners.operator.tekton.dev + name: tektontriggers.operator.tekton.dev labels: version: "devel" operator.tekton.dev/release: "devel" spec: group: operator.tekton.dev names: - kind: TektonPruner - listKind: TektonPrunerList - plural: tektonpruners - singular: tektonpruner + kind: TektonTrigger + listKind: TektonTriggerList + plural: tektontriggers + singular: tektontrigger scope: Cluster versions: - additionalPrinterColumns: @@ -6756,7 +6541,7 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: TektonPruner is the Schema for the TektonPruner API + description: TektonTrigger is the Schema for the tektontriggers API properties: apiVersion: description: |- @@ -6776,10 +6561,11 @@ spec: metadata: type: object spec: + description: TektonTriggerSpec defines the desired state of TektonTrigger properties: config: description: Config holds the configuration for resources created - by TektonPruner + by TektonTrigger properties: nodeSelector: additionalProperties: @@ -6828,136 +6614,16 @@ spec: type: object type: array type: object + default-service-account: + type: string disabled: - description: enable or disable TektonPruner Component + description: enable or disable Trigger Component type: boolean - global-config: - description: |- - GlobalConfig represents the global ConfigMap (tekton-pruner-default-spec) - Root-level fields are defaults; Namespaces map is for per-namespace defaults - NOTE: Selector support (PipelineRuns/TaskRuns arrays) is IGNORED in global ConfigMap - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: global, namespace - (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - namespaces: - additionalProperties: - description: |- - NamespaceSpec is used to hold the pruning config of a specific namespace and its resources - Used in both global ConfigMap (tekton-pruner-default-spec) and namespace ConfigMap (tekton-pruner-namespace-spec) - Selector support (PipelineRuns/TaskRuns arrays) ONLY works in namespace ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: global, - namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - pipelineRuns: - items: - description: |- - ResourceSpec is used to hold the config of a specific resource - Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: - global, namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - name: - type: string - selector: - items: - description: |- - SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun - Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps - properties: - matchAnnotations: - additionalProperties: - type: string - type: object - matchLabels: - additionalProperties: - type: string - description: Match by labels AND annotations. - If both are specified, BOTH must match (AND - logic) - type: object - type: object - type: array - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - type: array - successfulHistoryLimit: - type: integer - taskRuns: - items: - description: |- - ResourceSpec is used to hold the config of a specific resource - Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps - properties: - enforcedConfigLevel: - description: 'EnforcedConfigLevel allowed values: - global, namespace (default: namespace)' - type: string - failedHistoryLimit: - type: integer - historyLimit: - type: integer - name: - type: string - selector: - items: - description: |- - SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun - Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps - properties: - matchAnnotations: - additionalProperties: - type: string - type: object - matchLabels: - additionalProperties: - type: string - description: Match by labels AND annotations. - If both are specified, BOTH must match (AND - logic) - type: object - type: object - type: array - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - type: array - ttlSecondsAfterFinished: - type: integer - type: object - type: object - successfulHistoryLimit: - type: integer - ttlSecondsAfterFinished: - type: integer - type: object - x-kubernetes-preserve-unknown-fields: true - networkPolicy: - description: |- - NetworkPolicy configures NetworkPolicy creation for the controller - and webhook workloads deployed by TektonPruner. + enable-api-fields: + type: string + networkPolicy: + description: NetworkPolicy configures NetworkPolicy creation for TektonTrigger + workloads. properties: disabled: description: |- @@ -7479,10 +7145,9 @@ spec: type: string required: - disabled - - global-config type: object status: - description: TektonPrunerStatus defines the observed state of TektonPruner + description: TektonTriggerStatus defines the observed state of TektonTrigger properties: annotations: additionalProperties: @@ -7536,7 +7201,7 @@ spec: was last processed by the controller. type: integer tektonInstallerSet: - description: The current installer set name for TektonPruner + description: The current installer set name type: string version: description: The version of the installed release @@ -7553,17 +7218,17 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonschedulers.operator.tekton.dev + name: tektonpruners.operator.tekton.dev labels: version: "devel" operator.tekton.dev/release: "devel" spec: group: operator.tekton.dev names: - kind: TektonScheduler - listKind: TektonSchedulerList - plural: tektonschedulers - singular: tektonscheduler + kind: TektonPruner + listKind: TektonPrunerList + plural: tektonpruners + singular: tektonpruner scope: Cluster versions: - additionalPrinterColumns: @@ -7579,7 +7244,7 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: TektonScheduler is the Schema for the TektonScheduler API + description: TektonPruner is the Schema for the TektonPruner API properties: apiVersion: description: |- @@ -7600,225 +7265,2022 @@ spec: type: object spec: properties: - config.yaml: - description: |- - This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to - match the key here + config: + description: Config holds the configuration for resources created + by TektonPruner properties: - cel: - properties: - expressions: - items: - type: string - type: array + nodeSelector: + additionalProperties: + type: string type: object - multiKueueOverride: - type: boolean - queueName: + priorityClassName: + description: PriorityClassName holds the priority class to be + set to pod template type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array type: object - x-kubernetes-preserve-unknown-fields: true disabled: - description: enable or disable TektonScheduler Component - type: boolean - multi-cluster-disabled: + description: enable or disable TektonPruner Component type: boolean - multi-cluster-role: + global-config: description: |- - MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole - can be one of Hub or Spoke - type: string - options: - description: options holds additions fields and these fields will - be updated on the manifests + GlobalConfig represents the global ConfigMap (tekton-pruner-default-spec) + Root-level fields are defaults; Namespaces map is for per-namespace defaults + NOTE: Selector support (PipelineRuns/TaskRuns arrays) is IGNORED in global ConfigMap properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true - disabled: - type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: global, namespace + (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + namespaces: additionalProperties: - description: WebhookOptions defines options for webhooks + description: |- + NamespaceSpec is used to hold the pruning config of a specific namespace and its resources + Used in both global ConfigMap (tekton-pruner-default-spec) and namespace ConfigMap (tekton-pruner-namespace-spec) + Selector support (PipelineRuns/TaskRuns arrays) ONLY works in namespace ConfigMaps properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: global, + namespace (default: namespace)' type: string - timeoutSeconds: + failedHistoryLimit: type: integer - type: object - type: object - type: object - targetNamespace: - description: TargetNamespace is where resources will be installed - type: string - required: - - config.yaml - - disabled - - multi-cluster-disabled - - multi-cluster-role - type: object - status: - description: TektonSchedulerStatus defines the observed state of TektonScheduler - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. + historyLimit: + type: integer + pipelineRuns: + items: + description: |- + ResourceSpec is used to hold the config of a specific resource + Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps + properties: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: + global, namespace (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + name: + type: string + selector: + items: + description: |- + SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun + Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps + properties: + matchAnnotations: + additionalProperties: + type: string + type: object + matchLabels: + additionalProperties: + type: string + description: Match by labels AND annotations. + If both are specified, BOTH must match (AND + logic) + type: object + type: object + type: array + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer + type: object + type: array + successfulHistoryLimit: + type: integer + taskRuns: + items: + description: |- + ResourceSpec is used to hold the config of a specific resource + Only used in namespace-level ConfigMaps (tekton-pruner-namespace-spec), NOT in global ConfigMaps + properties: + enforcedConfigLevel: + description: 'EnforcedConfigLevel allowed values: + global, namespace (default: namespace)' + type: string + failedHistoryLimit: + type: integer + historyLimit: + type: integer + name: + type: string + selector: + items: + description: |- + SelectorSpec allows specifying selectors for matching resources like PipelineRun or TaskRun + Only applicable in namespace-level ConfigMaps, NOT in global ConfigMaps + properties: + matchAnnotations: + additionalProperties: + type: string + type: object + matchLabels: + additionalProperties: + type: string + description: Match by labels AND annotations. + If both are specified, BOTH must match (AND + logic) + type: object + type: object + type: array + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer + type: object + type: array + ttlSecondsAfterFinished: + type: integer + type: object + type: object + successfulHistoryLimit: + type: integer + ttlSecondsAfterFinished: + type: integer type: object - conditions: - description: Conditions the latest available observations of a resource's - current state. - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about - the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - required: - - status - - type - type: object - type: array - observedGeneration: + x-kubernetes-preserve-unknown-fields: true + networkPolicy: description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - tekton-scheduler: - description: The current installer set name for TektonScheduler - type: string - version: - description: The version of the installed release - type: string - type: object - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.18.0 - name: tektonmulticlusterproxyaaes.operator.tekton.dev - labels: - version: "devel" - operator.tekton.dev/release: "devel" -spec: - group: operator.tekton.dev - names: - kind: TektonMulticlusterProxyAAE - listKind: TektonMulticlusterProxyAAEList - plural: tektonmulticlusterproxyaaes - singular: tektonmulticlusterproxyaae - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.version - name: Version - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Reason - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE - API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - options: - description: options holds additional fields and these fields will - be updated on the manifests + NetworkPolicy configures NetworkPolicy creation for the controller + and webhook workloads deployed by TektonPruner. properties: - configMaps: - x-kubernetes-preserve-unknown-fields: true - deployments: - x-kubernetes-preserve-unknown-fields: true disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. type: boolean - horizontalPodAutoscalers: - x-kubernetes-preserve-unknown-fields: true - statefulSets: - x-kubernetes-preserve-unknown-fields: true - webhookConfigurationOptions: + policies: additionalProperties: - description: WebhookOptions defines options for webhooks + description: NetworkPolicySpec provides the specification of + a NetworkPolicy properties: - failurePolicy: - description: FailurePolicyType specifies a failure policy - that defines how unrecognized errors from the admission - endpoint are handled. - type: string - sideEffects: - description: SideEffectClass specifies the types of side - effects a webhook may have. - type: string - timeoutSeconds: - type: integer - type: object + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additions fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - global-config + type: object + status: + description: TektonPrunerStatus defines the observed state of TektonPruner + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's + current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPruner + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + name: tektonschedulers.operator.tekton.dev + labels: + version: "devel" + operator.tekton.dev/release: "devel" +spec: + group: operator.tekton.dev + names: + kind: TektonScheduler + listKind: TektonSchedulerList + plural: tektonschedulers + singular: tektonscheduler + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonScheduler is the Schema for the TektonScheduler API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + properties: + cel: + properties: + expressions: + items: + type: string + type: array + type: object + multiKueueOverride: + type: boolean + queueName: + type: string + type: object + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additions fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + type: object + status: + description: TektonSchedulerStatus defines the observed state of TektonScheduler + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's + current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + tekton-scheduler: + description: The current installer set name for TektonScheduler + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + name: tektonmulticlusterproxyaaes.operator.tekton.dev + labels: + version: "devel" + operator.tekton.dev/release: "devel" +spec: + group: operator.tekton.dev + names: + kind: TektonMulticlusterProxyAAE + listKind: TektonMulticlusterProxyAAEList + plural: tektonmulticlusterproxyaaes + singular: tektonmulticlusterproxyaae + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE + API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + options: + description: options holds additional fields and these fields will + be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy + that defines how unrecognized errors from the admission + endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side + effects a webhook may have. + type: string + timeoutSeconds: + type: integer + type: object type: object type: object targetNamespace: @@ -7984,18 +9446,505 @@ spec: type: string tolerationSeconds: description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - type: integer - value: + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic type: object - type: array + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true type: object options: description: Options holds additions fields and these fields will diff --git a/config/base/generated-crds/operator.tekton.dev_syncerservices.yaml b/config/base/generated-crds/operator.tekton.dev_syncerservices.yaml index a8ddc87a1d..607a7354ef 100644 --- a/config/base/generated-crds/operator.tekton.dev_syncerservices.yaml +++ b/config/base/generated-crds/operator.tekton.dev_syncerservices.yaml @@ -101,6 +101,495 @@ spec: type: object type: array type: object + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object options: description: Options holds additions fields and these fields will be updated on the manifests diff --git a/config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml b/config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml index 44d4f134e0..92a0e6b906 100644 --- a/config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml +++ b/config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml @@ -575,8 +575,9 @@ spec: networkPolicy: description: |- NetworkPolicy configures NetworkPolicy resources for the operand namespace. - This field is propagated to TektonTrigger, TektonPipeline, TektonChain, - TektonPruner, and TektonResult, which implement NetworkPolicy reconciliation. + This field is propagated to TektonPipeline, TektonTrigger, TektonChain, + TektonPruner, TektonResult, Pipelines-as-Code, and MultiCluster components + (TektonScheduler, TektonMulticlusterProxyAAE, SyncerService). Other components (Dashboard) do not yet act on this field. properties: disabled: diff --git a/config/base/generated-crds/operator.tekton.dev_tektonmulticlusterproxyaaes.yaml b/config/base/generated-crds/operator.tekton.dev_tektonmulticlusterproxyaaes.yaml index 17547bacf9..a6cb2a06c7 100644 --- a/config/base/generated-crds/operator.tekton.dev_tektonmulticlusterproxyaaes.yaml +++ b/config/base/generated-crds/operator.tekton.dev_tektonmulticlusterproxyaaes.yaml @@ -49,6 +49,495 @@ spec: type: object spec: properties: + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object options: description: options holds additional fields and these fields will be updated on the manifests diff --git a/config/base/generated-crds/operator.tekton.dev_tektonresults.yaml b/config/base/generated-crds/operator.tekton.dev_tektonresults.yaml index d3f27771a4..74dbe2b844 100644 --- a/config/base/generated-crds/operator.tekton.dev_tektonresults.yaml +++ b/config/base/generated-crds/operator.tekton.dev_tektonresults.yaml @@ -184,11 +184,483 @@ spec: Existing policies are removed on the next reconcile. type: boolean policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object description: |- Policies merges with the operator's default NetworkPolicies by name. A key matching a default policy name replaces that default entirely. A key not matching any default is added alongside the defaults. If nil or empty, all operator defaults are applied unchanged. + type: object x-kubernetes-preserve-unknown-fields: true type: object options: diff --git a/config/base/generated-crds/operator.tekton.dev_tektonschedulers.yaml b/config/base/generated-crds/operator.tekton.dev_tektonschedulers.yaml index 55d62fc4b1..a00957cc83 100644 --- a/config/base/generated-crds/operator.tekton.dev_tektonschedulers.yaml +++ b/config/base/generated-crds/operator.tekton.dev_tektonschedulers.yaml @@ -76,6 +76,495 @@ spec: MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole can be one of Hub or Spoke type: string + networkPolicy: + description: NetworkPolicyConfig configures NetworkPolicy creation + for a Tekton component. + properties: + disabled: + description: |- + Disabled disables all NetworkPolicy creation for this component. + Existing policies are removed on the next reconcile. + type: boolean + policies: + additionalProperties: + description: NetworkPolicySpec provides the specification of + a NetworkPolicy + properties: + egress: + description: |- + egress is a list of egress rules to be applied to the selected pods. Outgoing traffic + is allowed if there are no NetworkPolicies selecting the pod (and cluster policy + otherwise allows the traffic), OR if the traffic matches at least one egress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy limits all outgoing traffic (and serves + solely to ensure that the pods it selects are isolated by default). + This field is beta-level in 1.8 + items: + description: |- + NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. + This type is beta-level in 1.8 + properties: + ports: + description: |- + ports is a list of destination ports for outgoing traffic. + Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + to: + description: |- + to is a list of destinations for outgoing traffic of pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all destinations (traffic not restricted by + destination). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the to list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ingress: + description: |- + ingress is a list of ingress rules to be applied to the selected pods. + Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod + (and cluster policy otherwise allows the traffic), OR if the traffic source is + the pod's local node, OR if the traffic matches at least one ingress rule + across all of the NetworkPolicy objects whose podSelector matches the pod. If + this field is empty then this NetworkPolicy does not allow any traffic (and serves + solely to ensure that the pods it selects are isolated by default) + items: + description: |- + NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods + matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from. + properties: + from: + description: |- + from is a list of sources which should be able to access the pods selected for this rule. + Items in this list are combined using a logical OR operation. If this field is + empty or missing, this rule matches all sources (traffic not restricted by + source). If this field is present and contains at least one item, this rule + allows traffic only if the traffic matches at least one item in the from list. + items: + description: |- + NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of + fields are allowed + properties: + ipBlock: + description: |- + ipBlock defines policy on a particular IPBlock. If this field is set then + neither of the other fields can be. + properties: + cidr: + description: |- + cidr is a string representing the IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + type: string + except: + description: |- + except is a slice of CIDRs that should not be included within an IPBlock + Valid examples are "192.168.1.0/24" or "2001:db8::/64" + Except values will be rejected if they are outside the cidr range + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - cidr + type: object + namespaceSelector: + description: |- + namespaceSelector selects namespaces using cluster-scoped labels. This field follows + standard label selector semantics; if present but empty, it selects all namespaces. + + If podSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the namespaces selected by namespaceSelector. + Otherwise it selects all pods in the namespaces selected by namespaceSelector. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podSelector: + description: |- + podSelector is a label selector which selects pods. This field follows standard label + selector semantics; if present but empty, it selects all pods. + + If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects + the pods matching podSelector in the Namespaces selected by NamespaceSelector. + Otherwise it selects the pods matching podSelector in the policy's own namespace. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + ports is a list of ports which should be made accessible on the pods selected for + this rule. Each item in this list is combined using a logical OR. If this field is + empty or missing, this rule matches all ports (traffic not restricted by port). + If this field is present and contains at least one item, then this rule allows + traffic only if the traffic matches at least one port in the list. + items: + description: NetworkPolicyPort describes a port + to allow traffic on + properties: + endPort: + description: |- + endPort indicates that the range of ports from port to endPort if set, inclusive, + should be allowed by the policy. This field cannot be defined if the port field + is not defined or if the port field is defined as a named (string) port. + The endPort must be equal or greater than port. + format: int32 + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + port represents the port on the given protocol. This can either be a numerical or named + port on a pod. If this field is not provided, this matches all port names and + numbers. + If present, only traffic on the specified protocol AND port will be matched. + x-kubernetes-int-or-string: true + protocol: + description: |- + protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. + If not specified, this field defaults to TCP. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: array + x-kubernetes-list-type: atomic + podSelector: + description: |- + podSelector selects the pods to which this NetworkPolicy object applies. + The array of rules is applied to any pods selected by this field. An empty + selector matches all pods in the policy's namespace. + Multiple network policies can select the same set of pods. In this case, + the ingress rules for each are combined additively. + This field is optional. If it is not specified, it defaults to an empty selector. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + policyTypes: + description: |- + policyTypes is a list of rule types that the NetworkPolicy relates to. + Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. + If this field is not specified, it will default based on the existence of ingress or egress rules; + policies that contain an egress section are assumed to affect egress, and all policies + (whether or not they contain an ingress section) are assumed to affect ingress. + If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. + Likewise, if you want to write a policy that specifies that no egress is allowed, + you must specify a policyTypes value that include "Egress" (since such a policy would not include + an egress section and would otherwise default to just [ "Ingress" ]). + This field is beta-level in 1.8 + items: + description: |- + PolicyType string describes the NetworkPolicy type + This type is beta-level in 1.8 + type: string + type: array + x-kubernetes-list-type: atomic + type: object + description: |- + Policies merges with the operator's default NetworkPolicies by name. + A key matching a default policy name replaces that default entirely. + A key not matching any default is added alongside the defaults. + If nil or empty, all operator defaults are applied unchanged. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object options: description: options holds additions fields and these fields will be updated on the manifests diff --git a/docs/NetworkPolicy.md b/docs/NetworkPolicy.md index a0328112b1..18460a4e71 100644 --- a/docs/NetworkPolicy.md +++ b/docs/NetworkPolicy.md @@ -7,9 +7,10 @@ weight: 15 # NetworkPolicy The operator can manage [NetworkPolicy][np] resources for Tekton component workloads. -Currently TektonPipeline (core controllers, resolvers, and proxy-webhook), -TektonTrigger, TektonChain, Pipelines-as-Code, ManualApprovalGate, TektonPruner, -and TektonResult are supported; other components will be added later. +TektonPipeline (core controllers, resolvers, and proxy-webhook), TektonTrigger, +TektonChain, Pipelines-as-Code, ManualApprovalGate, TektonPruner, TektonResult, +and MultiCluster components (TektonScheduler, TektonMulticlusterProxyAAE, +SyncerService) are supported; other components will be added later. Configuration is available via `TektonConfig`: @@ -32,12 +33,12 @@ spec: - port: 9000 ``` -The `networkPolicy` field is propagated from `TektonConfig` to `TektonTrigger`, -`TektonPipeline`, `TektonChain`, `TektonPruner`, and `TektonResult`. When those -component CRs are managed by `TektonConfig` (the usual install path), -**TektonConfig is the source of truth**: edits to `spec.networkPolicy` on the -component CRs alone are overwritten on the next Config reconcile. Configure -NetworkPolicy via `TektonConfig.spec.networkPolicy`. +The `networkPolicy` field is propagated from `TektonConfig` to `TektonPipeline`, +`TektonTrigger`, `TektonChain`, `TektonPruner`, `TektonResult`, Pipelines-as-Code, +and MultiCluster components. When those component CRs are managed by `TektonConfig` +(the usual install path), **TektonConfig is the source of truth**: edits to +`spec.networkPolicy` on the component CRs alone are overwritten on the next Config +reconcile. Configure NetworkPolicy via `TektonConfig.spec.networkPolicy`. ## Default Policies @@ -256,8 +257,49 @@ user's browser via the OpenShift Console's proxy, not on this pod. These are static manifests shipped with the TektonConfig console plugin resources, not reconciled via `spec.networkPolicy`. -All policies above are applied to the operand namespace (e.g. `tekton-pipelines` -or `openshift-pipelines`). They do not cover the operator's own namespace +### TektonScheduler + +Policies are applied to the operand namespace (`tekton-pipelines` or `openshift-pipelines`). + +| Policy | Direction | Port | Source / Destination | +|---|---|---|---| +| `scheduler-controller-default-deny` | deny all | — | Scheduler controller pods | +| `scheduler-webhook-default-deny` | deny all | — | Scheduler webhook pods | +| `scheduler-controller` | ingress | TCP/8443 | Prometheus namespace | +| | egress | UDP+TCP/53 (K8s) or 5353 (OpenShift) | DNS resolver pods | +| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | +| `scheduler-webhook` | ingress | TCP/9443 | Any (admission webhook) | +| | ingress | TCP/8443 | Prometheus namespace | +| | egress | UDP+TCP/53 or 5353 | DNS resolver pods | +| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | + +### TektonMulticlusterProxyAAE + +Policies are applied to the operand namespace (`tekton-pipelines` or `openshift-pipelines`). +Deployed only when the scheduler is enabled with multi-cluster role = Hub. + +| Policy | Direction | Port | Source / Destination | +|---|---|---|---| +| `proxy-aae-default-deny` | deny all | — | Proxy-AAE pods (`app: proxy-aae`) | +| `proxy-aae` | ingress | TCP/8080 | Any (spoke clusters connect via service 443→8080) | +| | egress | UDP+TCP/53 (K8s) or 5353 (OpenShift) | DNS resolver pods | +| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | + +### SyncerService (OpenShift only) + +Policies are applied to the operand namespace (`openshift-pipelines`). +Deployed only when the scheduler is enabled with multi-cluster role = Hub. + +| Policy | Direction | Port | Source / Destination | +|---|---|---|---| +| `syncer-service-default-deny` | deny all | — | SyncerService pods (`app: workload-controller`) | +| `syncer-service-controller` | egress | UDP+TCP/5353 | DNS resolver pods (OpenShift) | +| | egress | all | API server (all egress allowed — NP cannot select host-network endpoints) | + +All component policies (TektonPipeline, TektonTrigger, TektonScheduler, +TektonMulticlusterProxyAAE, SyncerService, and Console Plugin) are applied to the +operand namespace (e.g. `tekton-pipelines` or `openshift-pipelines`). +None of these cover the operator's own namespace (`tekton-operator` / `openshift-operators`), which ships fixed, non-configurable NetworkPolicies as part of the operator's own install manifests/bundle (see [Operator's own namespace](#operators-own-namespace) below). diff --git a/pkg/apis/operator/v1alpha1/syncerservice_types.go b/pkg/apis/operator/v1alpha1/syncerservice_types.go index 7f361138a7..81b41fe82c 100644 --- a/pkg/apis/operator/v1alpha1/syncerservice_types.go +++ b/pkg/apis/operator/v1alpha1/syncerservice_types.go @@ -62,6 +62,8 @@ type SyncerServiceSpec struct { // Config holds the configuration for resources created by SyncerService // +optional Config Config `json:"config,omitempty"` + // +optional + NetworkPolicy NetworkPolicyConfig `json:"networkPolicy,omitempty"` } // SyncerServiceOptions defines the fields to customize SyncerService component @@ -89,7 +91,8 @@ func (sss *SyncerServiceStatus) MarkPreReconcilerFailed(msg string) { syncerServiceCondSet.Manage(sss).MarkFalse( PreReconciler, "Error", - msg) + msg, + ) } func (sss *SyncerServiceStatus) MarkPostReconcilerFailed(msg string) { @@ -97,7 +100,8 @@ func (sss *SyncerServiceStatus) MarkPostReconcilerFailed(msg string) { syncerServiceCondSet.Manage(sss).MarkFalse( PostReconciler, "Error", - msg) + msg, + ) } // SyncerServiceList contains a list of SyncerService diff --git a/pkg/apis/operator/v1alpha1/syncerservice_validation.go b/pkg/apis/operator/v1alpha1/syncerservice_validation.go index 0ac14ef368..0adecdc6fe 100644 --- a/pkg/apis/operator/v1alpha1/syncerservice_validation.go +++ b/pkg/apis/operator/v1alpha1/syncerservice_validation.go @@ -33,5 +33,6 @@ func (ss *SyncerService) Validate(ctx context.Context) (errs *apis.FieldError) { return errs.Also(apis.ErrInvalidValue(ss.GetName(), errMsg)) } + errs = errs.Also(ss.Spec.NetworkPolicy.validate("spec.networkPolicy")) return errs } diff --git a/pkg/apis/operator/v1alpha1/tektonconfig_types.go b/pkg/apis/operator/v1alpha1/tektonconfig_types.go index f7b9daa26c..a225e7132a 100644 --- a/pkg/apis/operator/v1alpha1/tektonconfig_types.go +++ b/pkg/apis/operator/v1alpha1/tektonconfig_types.go @@ -135,8 +135,9 @@ type TektonConfigSpec struct { // +optional TargetNamespaceMetadata *NamespaceMetadata `json:"targetNamespaceMetadata,omitempty"` // NetworkPolicy configures NetworkPolicy resources for the operand namespace. - // This field is propagated to TektonTrigger, TektonPipeline, TektonChain, - // TektonPruner, and TektonResult, which implement NetworkPolicy reconciliation. + // This field is propagated to TektonPipeline, TektonTrigger, TektonChain, + // TektonPruner, TektonResult, Pipelines-as-Code, and MultiCluster components + // (TektonScheduler, TektonMulticlusterProxyAAE, SyncerService). // Other components (Dashboard) do not yet act on this field. // +optional NetworkPolicy NetworkPolicyConfig `json:"networkPolicy,omitempty"` diff --git a/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_types.go b/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_types.go index be1b326cbc..9aef978cbb 100644 --- a/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_types.go +++ b/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_types.go @@ -48,6 +48,8 @@ type TektonMulticlusterProxyAAE struct { type TektonMulticlusterProxyAAESpec struct { CommonSpec `json:",inline"` MulticlusterProxyAAEOptions `json:",inline"` + // +optional + NetworkPolicy NetworkPolicyConfig `json:"networkPolicy,omitempty"` } type MulticlusterProxyAAEOptions struct { diff --git a/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_validation.go b/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_validation.go index f3906ee54f..d8cb991941 100644 --- a/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_validation.go +++ b/pkg/apis/operator/v1alpha1/tektonmulticlusterproxyaae_validation.go @@ -18,11 +18,22 @@ package v1alpha1 import ( "context" + "fmt" "knative.dev/pkg/apis" ) -// Validate implements the validation contract for the webhook. Reserved for future use. +// Validate implements the validation contract for the webhook. func (t *TektonMulticlusterProxyAAE) Validate(ctx context.Context) (errs *apis.FieldError) { - return nil + if apis.IsInDelete(ctx) { + return nil + } + + if t.GetName() != MultiClusterProxyAAEResourceName { + errMsg := fmt.Sprintf("metadata.name, Only one instance of TektonMulticlusterProxyAAE is allowed by name, %s", MultiClusterProxyAAEResourceName) + errs = errs.Also(apis.ErrInvalidValue(t.GetName(), errMsg)) + } + + errs = errs.Also(t.Spec.NetworkPolicy.validate("spec.networkPolicy")) + return errs } diff --git a/pkg/apis/operator/v1alpha1/tektonscheduler_types.go b/pkg/apis/operator/v1alpha1/tektonscheduler_types.go index 974d756ca0..25426d882b 100644 --- a/pkg/apis/operator/v1alpha1/tektonscheduler_types.go +++ b/pkg/apis/operator/v1alpha1/tektonscheduler_types.go @@ -85,6 +85,8 @@ type TektonSchedulerList struct { type TektonSchedulerSpec struct { CommonSpec `json:",inline"` Scheduler `json:",inline"` + // +optional + NetworkPolicy NetworkPolicyConfig `json:"networkPolicy,omitempty"` } // TektonSchedulerStatus defines the observed state of TektonScheduler diff --git a/pkg/apis/operator/v1alpha1/tektonscheduler_validation.go b/pkg/apis/operator/v1alpha1/tektonscheduler_validation.go index ae88cfff3a..f237cde490 100644 --- a/pkg/apis/operator/v1alpha1/tektonscheduler_validation.go +++ b/pkg/apis/operator/v1alpha1/tektonscheduler_validation.go @@ -25,7 +25,6 @@ import ( ) func (ts *TektonScheduler) Validate(ctx context.Context) (errs *apis.FieldError) { - if apis.IsInDelete(ctx) { return nil } @@ -37,6 +36,7 @@ func (ts *TektonScheduler) Validate(ctx context.Context) (errs *apis.FieldError) // execute common spec validations errs = errs.Also(ts.Spec.MultiClusterConfig.validate()) + errs = errs.Also(ts.Spec.NetworkPolicy.validate("spec.networkPolicy")) return errs } diff --git a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go index 5841278008..e2d4b2294a 100644 --- a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go @@ -1533,6 +1533,7 @@ func (in *SyncerServiceSpec) DeepCopyInto(out *SyncerServiceSpec) { out.CommonSpec = in.CommonSpec in.SyncerServiceOptions.DeepCopyInto(&out.SyncerServiceOptions) in.Config.DeepCopyInto(&out.Config) + in.NetworkPolicy.DeepCopyInto(&out.NetworkPolicy) return } @@ -2155,6 +2156,7 @@ func (in *TektonMulticlusterProxyAAESpec) DeepCopyInto(out *TektonMulticlusterPr *out = *in out.CommonSpec = in.CommonSpec in.MulticlusterProxyAAEOptions.DeepCopyInto(&out.MulticlusterProxyAAEOptions) + in.NetworkPolicy.DeepCopyInto(&out.NetworkPolicy) return } @@ -2562,6 +2564,7 @@ func (in *TektonSchedulerSpec) DeepCopyInto(out *TektonSchedulerSpec) { *out = *in out.CommonSpec = in.CommonSpec in.Scheduler.DeepCopyInto(&out.Scheduler) + in.NetworkPolicy.DeepCopyInto(&out.NetworkPolicy) return } diff --git a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/controller.go b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/controller.go index f5c646c448..8cc6971fb6 100644 --- a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/controller.go +++ b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/controller.go @@ -21,6 +21,7 @@ import ( tektonInstallerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektoninstallerset" tektonPipelineinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonpipeline" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/tools/cache" kubeclient "knative.dev/pkg/client/injection/kube/client" @@ -61,6 +62,11 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro logger.Fatal("Error while getting operator version", err) } + params := networkpolicy.KubernetesPlatformDefaults() + if v1alpha1.IsOpenShiftPlatform() { + params = networkpolicy.OpenShiftPlatformDefaults() + } + tisClient := operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets() metrics, _ := NewRecorder() c := &Reconciler{ @@ -70,6 +76,7 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro pipelineInformer: tektonPipelineinformer.Get(ctx), extension: generator(ctx), manifest: manifest, + platformParams: params, multiclusterProxyAAEVersion: proxyAAEVer, operatorVersion: operatorVer, } diff --git a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go index 758a9f5db1..c94f775532 100644 --- a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go +++ b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/finalize.go @@ -42,6 +42,11 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.Tekton return err } + if err := r.installerSetClient.CleanupCustomSet(ctx, proxyAAECustomSet); err != nil { + logger.Error("failed to cleanup network policy installerset", "error", err) + return err + } + if err := r.extension.Finalize(ctx, original); err != nil { logger.Error("Failed to finalize platform resources", "error", err) } diff --git a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies.go b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies.go new file mode 100644 index 0000000000..dcdeb9229d --- /dev/null +++ b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies.go @@ -0,0 +1,92 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package tektonmulticlusterproxyaae + +import ( + "context" + + mf "github.com/manifestival/manifestival" + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" + corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/intstr" +) + +const proxyAAECustomSet = "proxy-aae-network-policies" + +var proxyAAEPodSelector = metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "proxy-aae"}, +} + +func proxyAAEDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1.NetworkPolicy { + proxyPort := intstr.FromInt32(8080) + tcp := corev1.ProtocolTCP + + return []networkingv1.NetworkPolicy{ + { + ObjectMeta: metav1.ObjectMeta{Name: "proxy-aae"}, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: proxyAAEPodSelector, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress}, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + Ports: []networkingv1.NetworkPolicyPort{ + {Protocol: &tcp, Port: &proxyPort}, + }, + }, + }, + Egress: []networkingv1.NetworkPolicyEgressRule{ + networkpolicy.DNSEgressRule(params), + networkpolicy.APIServerEgressRule(), + }, + }, + }, + } +} + +func proxyAAEDefaultDenyPolicy() networkingv1.NetworkPolicy { + return networkpolicy.DefaultDenyPolicy("proxy-aae-default-deny", proxyAAEPodSelector) +} + +func (r *Reconciler) reconcileNetworkPolicies(ctx context.Context, proxy *v1alpha1.TektonMulticlusterProxyAAE) error { + if proxy.Spec.NetworkPolicy.Disabled { + return r.installerSetClient.CleanupCustomSet(ctx, proxyAAECustomSet) + } + defaults := []networkingv1.NetworkPolicy{ + proxyAAEDefaultDenyPolicy(), + } + defaults = append(defaults, proxyAAEDefaultPolicies(r.platformParams)...) + + manifest, err := networkpolicy.Generate( + proxy.Spec.NetworkPolicy, + proxy.Spec.GetTargetNamespace(), + defaults, + ) + if err != nil { + return err + } + return r.installerSetClient.CustomSet(ctx, proxy, proxyAAECustomSet, &manifest, passthroughTransform, nil) +} + +func passthroughTransform(_ context.Context, m *mf.Manifest, _ v1alpha1.TektonComponent) (*mf.Manifest, error) { + return m, nil +} + +var _ client.FilterAndTransform = passthroughTransform diff --git a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies_test.go b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies_test.go new file mode 100644 index 0000000000..a7a807688f --- /dev/null +++ b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/networkpolicies_test.go @@ -0,0 +1,108 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package tektonmulticlusterproxyaae + +import ( + "testing" + + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" +) + +func TestConstants(t *testing.T) { + if proxyAAECustomSet != "proxy-aae-network-policies" { + t.Errorf("expected custom set proxy-aae-network-policies, got %q", proxyAAECustomSet) + } +} + +func TestProxyAAEDefaultPolicies(t *testing.T) { + params := networkpolicy.KubernetesPlatformDefaults() + policies := proxyAAEDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + p := policies[0] + + if p.Name != "proxy-aae" { + t.Errorf("expected name proxy-aae, got %q", p.Name) + } + + labels := p.Spec.PodSelector.MatchLabels + if labels["app"] != "proxy-aae" { + t.Errorf("expected app=proxy-aae, got %q", labels["app"]) + } + + if len(p.Spec.PolicyTypes) != 2 { + t.Fatalf("expected 2 policy types, got %d", len(p.Spec.PolicyTypes)) + } + if p.Spec.PolicyTypes[0] != networkingv1.PolicyTypeIngress || p.Spec.PolicyTypes[1] != networkingv1.PolicyTypeEgress { + t.Errorf("expected [Ingress, Egress], got %v", p.Spec.PolicyTypes) + } + + // Ingress: TCP 8080 from any + if len(p.Spec.Ingress) != 1 { + t.Fatalf("expected 1 ingress rule, got %d", len(p.Spec.Ingress)) + } + ingressPorts := p.Spec.Ingress[0].Ports + if len(ingressPorts) != 1 { + t.Fatalf("expected 1 ingress port, got %d", len(ingressPorts)) + } + if ingressPorts[0].Port.IntVal != 8080 { + t.Errorf("expected ingress port 8080, got %d", ingressPorts[0].Port.IntVal) + } + if *ingressPorts[0].Protocol != corev1.ProtocolTCP { + t.Errorf("expected TCP protocol, got %v", *ingressPorts[0].Protocol) + } + if len(p.Spec.Ingress[0].From) != 0 { + t.Errorf("expected ingress from any (no From restriction), got %v", p.Spec.Ingress[0].From) + } + + // Egress: DNS + API server + if len(p.Spec.Egress) != 2 { + t.Fatalf("expected 2 egress rules (DNS + API server), got %d", len(p.Spec.Egress)) + } +} + +func TestProxyAAEDefaultDenyPolicy(t *testing.T) { + p := proxyAAEDefaultDenyPolicy() + + if p.Name != "proxy-aae-default-deny" { + t.Errorf("expected name proxy-aae-default-deny, got %q", p.Name) + } + if p.Spec.PodSelector.MatchLabels["app"] != "proxy-aae" { + t.Errorf("expected deny scoped to app=proxy-aae, got %v", p.Spec.PodSelector.MatchLabels) + } +} + +func TestProxyAAEPolicies_OpenShift(t *testing.T) { + params := networkpolicy.OpenShiftPlatformDefaults() + policies := proxyAAEDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + + egressDNS := policies[0].Spec.Egress[0] + if len(egressDNS.Ports) < 1 { + t.Fatal("expected DNS egress ports") + } + if egressDNS.Ports[0].Port.IntVal != 5353 { + t.Errorf("expected OpenShift DNS port 5353, got %d", egressDNS.Ports[0].Port.IntVal) + } +} diff --git a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/reconcile.go b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/reconcile.go index 6b6d564b2e..49d54f0f44 100644 --- a/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/reconcile.go +++ b/pkg/reconciler/kubernetes/tektonmulticlusterproxyaae/reconcile.go @@ -26,6 +26,7 @@ import ( pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1" proxyAAEreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonmulticlusterproxyaae" "github.com/tektoncd/operator/pkg/reconciler/common" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/kubernetes" "knative.dev/pkg/logging" @@ -40,6 +41,7 @@ type Reconciler struct { pipelineInformer pipelineinformer.TektonPipelineInformer manifest mf.Manifest extension common.Extension + platformParams networkpolicy.PlatformParams multiclusterProxyAAEVersion string operatorVersion string } @@ -54,7 +56,8 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, proxy *v1alpha1.TektonMu proxy.Status.SetVersion(r.multiclusterProxyAAEVersion) if proxy.GetName() != v1alpha1.MultiClusterProxyAAEResourceName { - msg := fmt.Sprintf("Resource ignored, Expected Name: %s, Got Name: %s", + msg := fmt.Sprintf( + "Resource ignored, Expected Name: %s, Got Name: %s", v1alpha1.MultiClusterProxyAAEResourceName, proxy.GetName(), ) @@ -100,6 +103,16 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, proxy *v1alpha1.TektonMu return err } + if err := r.reconcileNetworkPolicies(ctx, proxy); err != nil { + if err == v1alpha1.REQUEUE_EVENT_AFTER { + return err + } + msg := fmt.Sprintf("NetworkPolicy reconciliation failed: %s", err.Error()) + logger.Errorw("NetworkPolicy reconciliation failed", "error", err) + proxy.Status.MarkInstallerSetNotReady(msg) + return nil + } + if err := r.extension.PostReconcile(ctx, proxy); err != nil { msg := fmt.Sprintf("PostReconciliation failed: %s", err.Error()) logger.Error(msg) diff --git a/pkg/reconciler/kubernetes/tektonscheduler/controller.go b/pkg/reconciler/kubernetes/tektonscheduler/controller.go index 8bd9f79a92..a02b394e21 100644 --- a/pkg/reconciler/kubernetes/tektonscheduler/controller.go +++ b/pkg/reconciler/kubernetes/tektonscheduler/controller.go @@ -21,6 +21,7 @@ import ( tektonInstallerinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektoninstallerset" tektonPipelineinformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonpipeline" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/tools/cache" kubeclient "knative.dev/pkg/client/injection/kube/client" @@ -58,6 +59,11 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro logger.Fatal("Error while getting operator version", err) } + params := networkpolicy.KubernetesPlatformDefaults() + if v1alpha1.IsOpenShiftPlatform() { + params = networkpolicy.OpenShiftPlatformDefaults() + } + tisClient := operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets() metrics, _ := NewRecorder() c := &Reconciler{ @@ -67,6 +73,7 @@ func NewExtendedController(generator common.ExtensionGenerator) injection.Contro installerSetClient: client.NewInstallerSetClient(tisClient, operatorVer, schedulerVer, v1alpha1.KindTektonScheduler, metrics), extension: generator(ctx), manifest: manifest, + platformParams: params, tektonSchedulerVersion: schedulerVer, operatorVersion: operatorVer, } diff --git a/pkg/reconciler/kubernetes/tektonscheduler/finalize.go b/pkg/reconciler/kubernetes/tektonscheduler/finalize.go index f452726453..7b23314225 100644 --- a/pkg/reconciler/kubernetes/tektonscheduler/finalize.go +++ b/pkg/reconciler/kubernetes/tektonscheduler/finalize.go @@ -32,9 +32,9 @@ var _ tektonscheduler.Finalizer = (*Reconciler)(nil) func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.TektonScheduler) pkgreconciler.Event { logger := logging.FromContext(ctx) - //Delete CRDs before deleting rest of resources so that any instance - //of CRDs which has finalizer set will get deleted before we remove - //the controller;s deployment for it + // Delete CRDs before deleting rest of resources so that any instance + // of CRDs which has finalizer set will get deleted before we remove + // the controller;s deployment for it if err := r.manifest.Filter(mf.CRDs).Delete(); err != nil { logger.Error("Failed to deleted CRDs for TektonScheduler") return err @@ -45,6 +45,11 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.Tekton return err } + if err := r.installerSetClient.CleanupCustomSet(ctx, schedulerCustomSet); err != nil { + logger.Error("failed to cleanup network policy installerset: ", err) + return err + } + if err := r.extension.Finalize(ctx, original); err != nil { logger.Error("Failed to finalize platform resources", err) } diff --git a/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies.go b/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies.go new file mode 100644 index 0000000000..45fae2f3a1 --- /dev/null +++ b/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies.go @@ -0,0 +1,121 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package tektonscheduler + +import ( + "context" + + mf "github.com/manifestival/manifestival" + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/intstr" +) + +const schedulerCustomSet = "scheduler-network-policies" + +func schedulerControllerDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1.NetworkPolicy { + metricsPort := intstr.FromInt32(8443) + + return []networkingv1.NetworkPolicy{ + { + ObjectMeta: metav1.ObjectMeta{Name: "scheduler-controller"}, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: schedulerControllerSelector, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress}, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + networkpolicy.PrometheusIngressRule(params, metricsPort), + }, + Egress: []networkingv1.NetworkPolicyEgressRule{ + networkpolicy.DNSEgressRule(params), + networkpolicy.APIServerEgressRule(), + }, + }, + }, + } +} + +func schedulerWebhookDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1.NetworkPolicy { + webhookPort := intstr.FromInt32(9443) + metricsPort := intstr.FromInt32(8443) + + return []networkingv1.NetworkPolicy{ + { + ObjectMeta: metav1.ObjectMeta{Name: "scheduler-webhook"}, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: schedulerWebhookSelector, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress}, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + networkpolicy.WebhookIngressRule("", webhookPort), + networkpolicy.PrometheusIngressRule(params, metricsPort), + }, + Egress: []networkingv1.NetworkPolicyEgressRule{ + networkpolicy.DNSEgressRule(params), + networkpolicy.APIServerEgressRule(), + }, + }, + }, + } +} + +var schedulerControllerSelector = metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app.kubernetes.io/name": "tekton-kueue", + "control-plane": "controller-manager", + }, +} + +var schedulerWebhookSelector = metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app.kubernetes.io/name": "tekton-kueue-webhook", + "control-plane": "controller-manager", + }, +} + +func schedulerDefaultDenyPolicies() []networkingv1.NetworkPolicy { + return []networkingv1.NetworkPolicy{ + networkpolicy.DefaultDenyPolicy("scheduler-controller-default-deny", schedulerControllerSelector), + networkpolicy.DefaultDenyPolicy("scheduler-webhook-default-deny", schedulerWebhookSelector), + } +} + +func (r *Reconciler) reconcileNetworkPolicies(ctx context.Context, ts *v1alpha1.TektonScheduler) error { + if ts.Spec.NetworkPolicy.Disabled { + return r.installerSetClient.CleanupCustomSet(ctx, schedulerCustomSet) + } + defaults := schedulerDefaultDenyPolicies() + defaults = append(defaults, schedulerControllerDefaultPolicies(r.platformParams)...) + defaults = append(defaults, schedulerWebhookDefaultPolicies(r.platformParams)...) + + manifest, err := networkpolicy.Generate( + ts.Spec.NetworkPolicy, + ts.Spec.GetTargetNamespace(), + defaults, + ) + if err != nil { + return err + } + return r.installerSetClient.CustomSet(ctx, ts, schedulerCustomSet, &manifest, passthroughTransform, nil) +} + +func passthroughTransform(_ context.Context, m *mf.Manifest, _ v1alpha1.TektonComponent) (*mf.Manifest, error) { + return m, nil +} + +var _ client.FilterAndTransform = passthroughTransform diff --git a/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies_test.go b/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies_test.go new file mode 100644 index 0000000000..0e9fe754a4 --- /dev/null +++ b/pkg/reconciler/kubernetes/tektonscheduler/networkpolicies_test.go @@ -0,0 +1,147 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package tektonscheduler + +import ( + "testing" + + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + networkingv1 "k8s.io/api/networking/v1" +) + +func TestConstants(t *testing.T) { + if schedulerCustomSet != "scheduler-network-policies" { + t.Errorf("expected custom set scheduler-network-policies, got %q", schedulerCustomSet) + } +} + +func TestSchedulerControllerDefaultPolicies(t *testing.T) { + params := networkpolicy.KubernetesPlatformDefaults() + policies := schedulerControllerDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + p := policies[0] + + if p.Name != "scheduler-controller" { + t.Errorf("expected name scheduler-controller, got %q", p.Name) + } + + labels := p.Spec.PodSelector.MatchLabels + if labels["app.kubernetes.io/name"] != "tekton-kueue" { + t.Errorf("expected app.kubernetes.io/name=tekton-kueue, got %q", labels["app.kubernetes.io/name"]) + } + if labels["control-plane"] != "controller-manager" { + t.Errorf("expected control-plane=controller-manager, got %q", labels["control-plane"]) + } + + if len(p.Spec.PolicyTypes) != 2 { + t.Fatalf("expected 2 policy types, got %d", len(p.Spec.PolicyTypes)) + } + if p.Spec.PolicyTypes[0] != networkingv1.PolicyTypeIngress || p.Spec.PolicyTypes[1] != networkingv1.PolicyTypeEgress { + t.Errorf("expected [Ingress, Egress], got %v", p.Spec.PolicyTypes) + } + + if len(p.Spec.Ingress) != 1 { + t.Fatalf("expected 1 ingress rule (Prometheus), got %d", len(p.Spec.Ingress)) + } + if len(p.Spec.Ingress[0].Ports) != 1 || p.Spec.Ingress[0].Ports[0].Port.IntVal != 8443 { + t.Errorf("expected Prometheus ingress on port 8443, got %v", p.Spec.Ingress[0].Ports) + } + + if len(p.Spec.Egress) != 2 { + t.Fatalf("expected 2 egress rules (DNS + API server), got %d", len(p.Spec.Egress)) + } +} + +func TestSchedulerWebhookDefaultPolicies(t *testing.T) { + params := networkpolicy.KubernetesPlatformDefaults() + policies := schedulerWebhookDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + p := policies[0] + + if p.Name != "scheduler-webhook" { + t.Errorf("expected name scheduler-webhook, got %q", p.Name) + } + + labels := p.Spec.PodSelector.MatchLabels + if labels["app.kubernetes.io/name"] != "tekton-kueue-webhook" { + t.Errorf("expected app.kubernetes.io/name=tekton-kueue-webhook, got %q", labels["app.kubernetes.io/name"]) + } + if labels["control-plane"] != "controller-manager" { + t.Errorf("expected control-plane=controller-manager, got %q", labels["control-plane"]) + } + + if len(p.Spec.Ingress) != 2 { + t.Fatalf("expected 2 ingress rules (webhook + Prometheus), got %d", len(p.Spec.Ingress)) + } + if p.Spec.Ingress[0].Ports[0].Port.IntVal != 9443 { + t.Errorf("expected webhook ingress on port 9443, got %d", p.Spec.Ingress[0].Ports[0].Port.IntVal) + } + if p.Spec.Ingress[1].Ports[0].Port.IntVal != 8443 { + t.Errorf("expected Prometheus ingress on port 8443, got %d", p.Spec.Ingress[1].Ports[0].Port.IntVal) + } + + if len(p.Spec.Egress) != 2 { + t.Fatalf("expected 2 egress rules (DNS + API server), got %d", len(p.Spec.Egress)) + } +} + +func TestSchedulerDefaultDenyPolicies(t *testing.T) { + policies := schedulerDefaultDenyPolicies() + + if len(policies) != 2 { + t.Fatalf("expected 2 default-deny policies, got %d", len(policies)) + } + + ctrl := policies[0] + if ctrl.Name != "scheduler-controller-default-deny" { + t.Errorf("expected name scheduler-controller-default-deny, got %q", ctrl.Name) + } + if ctrl.Spec.PodSelector.MatchLabels["app.kubernetes.io/name"] != "tekton-kueue" { + t.Errorf("expected controller deny scoped to tekton-kueue, got %v", ctrl.Spec.PodSelector.MatchLabels) + } + + wh := policies[1] + if wh.Name != "scheduler-webhook-default-deny" { + t.Errorf("expected name scheduler-webhook-default-deny, got %q", wh.Name) + } + if wh.Spec.PodSelector.MatchLabels["app.kubernetes.io/name"] != "tekton-kueue-webhook" { + t.Errorf("expected webhook deny scoped to tekton-kueue-webhook, got %v", wh.Spec.PodSelector.MatchLabels) + } +} + +func TestSchedulerControllerPolicies_OpenShift(t *testing.T) { + params := networkpolicy.OpenShiftPlatformDefaults() + policies := schedulerControllerDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + + egressDNS := policies[0].Spec.Egress[0] + if len(egressDNS.Ports) < 1 { + t.Fatal("expected DNS egress ports") + } + if egressDNS.Ports[0].Port.IntVal != 5353 { + t.Errorf("expected OpenShift DNS port 5353, got %d", egressDNS.Ports[0].Port.IntVal) + } +} diff --git a/pkg/reconciler/kubernetes/tektonscheduler/reconcile.go b/pkg/reconciler/kubernetes/tektonscheduler/reconcile.go index be09b2884f..47ce68d5ed 100644 --- a/pkg/reconciler/kubernetes/tektonscheduler/reconcile.go +++ b/pkg/reconciler/kubernetes/tektonscheduler/reconcile.go @@ -27,6 +27,7 @@ import ( pipelineinformer "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1" TektonSchedulerreconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/tektonscheduler" "github.com/tektoncd/operator/pkg/reconciler/common" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/kubernetes" "knative.dev/pkg/logging" @@ -48,6 +49,8 @@ type Reconciler struct { manifest mf.Manifest // Platform-specific behavior to affect the transform extension common.Extension + // platformParams holds platform-specific values for building NetworkPolicy rules + platformParams networkpolicy.PlatformParams // version of scheduler which we are installing tektonSchedulerVersion string operatorVersion string @@ -64,7 +67,8 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, TektonScheduler *v1alpha TektonScheduler.Status.SetVersion(r.tektonSchedulerVersion) if TektonScheduler.GetName() != v1alpha1.TektonSchedulerResourceName { - msg := fmt.Sprintf("Resource ignored, Expected Name: %s, Got Name: %s", + msg := fmt.Sprintf( + "Resource ignored, Expected Name: %s, Got Name: %s", v1alpha1.TektonSchedulerResourceName, TektonScheduler.GetName(), ) @@ -108,6 +112,16 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, TektonScheduler *v1alpha return err } + if err := r.reconcileNetworkPolicies(ctx, TektonScheduler); err != nil { + if err == v1alpha1.REQUEUE_EVENT_AFTER { + return err + } + msg := fmt.Sprintf("NetworkPolicy reconciliation failed: %s", err.Error()) + logger.Errorw("NetworkPolicy reconciliation failed", "error", err) + TektonScheduler.Status.MarkInstallerSetNotReady(msg) + return nil + } + if err := r.extension.PostReconcile(ctx, TektonScheduler); err != nil { msg := fmt.Sprintf("PostReconciliation failed: %s", err.Error()) logger.Error(msg) @@ -143,5 +157,4 @@ func (r *Reconciler) ensureDependenciesInstalled(TektonScheduler *v1alpha1.Tekto } return nil - } diff --git a/pkg/reconciler/openshift/syncerservice/controller.go b/pkg/reconciler/openshift/syncerservice/controller.go index 5e825e3d69..e68c63dbec 100644 --- a/pkg/reconciler/openshift/syncerservice/controller.go +++ b/pkg/reconciler/openshift/syncerservice/controller.go @@ -26,6 +26,7 @@ import ( tektonPipelineInformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonpipeline" syncerServiceReconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/syncerservice" "github.com/tektoncd/operator/pkg/reconciler/common" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/tools/cache" kubeclient "knative.dev/pkg/client/injection/kube/client" @@ -63,6 +64,7 @@ func NewController(ctx context.Context, cmw configmap.Watcher) *controller.Impl operatorClientSet: operatorclient.Get(ctx), extension: OpenShiftExtension(ctx), manifest: manifest, + platformParams: networkpolicy.OpenShiftPlatformDefaults(), pipelineInformer: tektonPipelineInformer.Get(ctx), operatorVersion: operatorVer, syncerVersion: syncerVer, diff --git a/pkg/reconciler/openshift/syncerservice/finalize.go b/pkg/reconciler/openshift/syncerservice/finalize.go index e9613f2123..b00a9800e8 100644 --- a/pkg/reconciler/openshift/syncerservice/finalize.go +++ b/pkg/reconciler/openshift/syncerservice/finalize.go @@ -45,6 +45,11 @@ func (r *Reconciler) FinalizeKind(ctx context.Context, original *v1alpha1.Syncer return err } + if err := r.installerSetClient.CleanupCustomSet(ctx, syncerServiceCustomSet); err != nil { + logger.Error("Failed to cleanup network policy installerset", err) + return err + } + if err := r.extension.Finalize(ctx, original); err != nil { logger.Error("Failed to finalize platform resources", err) } diff --git a/pkg/reconciler/openshift/syncerservice/networkpolicies.go b/pkg/reconciler/openshift/syncerservice/networkpolicies.go new file mode 100644 index 0000000000..3a781c8751 --- /dev/null +++ b/pkg/reconciler/openshift/syncerservice/networkpolicies.go @@ -0,0 +1,80 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package syncerservice + +import ( + "context" + + mf "github.com/manifestival/manifestival" + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +const syncerServiceCustomSet = "syncer-service-network-policies" + +var syncerServicePodSelector = metav1.LabelSelector{ + MatchLabels: map[string]string{"app": "workload-controller"}, +} + +func syncerServiceDefaultPolicies(params networkpolicy.PlatformParams) []networkingv1.NetworkPolicy { + return []networkingv1.NetworkPolicy{ + { + ObjectMeta: metav1.ObjectMeta{Name: "syncer-service-controller"}, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: syncerServicePodSelector, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + Egress: []networkingv1.NetworkPolicyEgressRule{ + networkpolicy.DNSEgressRule(params), + networkpolicy.APIServerEgressRule(), + }, + }, + }, + } +} + +func syncerServiceDefaultDenyPolicy() networkingv1.NetworkPolicy { + return networkpolicy.DefaultDenyPolicy("syncer-service-default-deny", syncerServicePodSelector) +} + +func (r *Reconciler) reconcileNetworkPolicies(ctx context.Context, ss *v1alpha1.SyncerService) error { + if ss.Spec.NetworkPolicy.Disabled { + return r.installerSetClient.CleanupCustomSet(ctx, syncerServiceCustomSet) + } + defaults := []networkingv1.NetworkPolicy{ + syncerServiceDefaultDenyPolicy(), + } + defaults = append(defaults, syncerServiceDefaultPolicies(r.platformParams)...) + + manifest, err := networkpolicy.Generate( + ss.Spec.NetworkPolicy, + ss.Spec.GetTargetNamespace(), + defaults, + ) + if err != nil { + return err + } + return r.installerSetClient.CustomSet(ctx, ss, syncerServiceCustomSet, &manifest, passthroughTransform, nil) +} + +func passthroughTransform(_ context.Context, m *mf.Manifest, _ v1alpha1.TektonComponent) (*mf.Manifest, error) { + return m, nil +} + +var _ client.FilterAndTransform = passthroughTransform diff --git a/pkg/reconciler/openshift/syncerservice/networkpolicies_test.go b/pkg/reconciler/openshift/syncerservice/networkpolicies_test.go new file mode 100644 index 0000000000..8bcb5c1323 --- /dev/null +++ b/pkg/reconciler/openshift/syncerservice/networkpolicies_test.go @@ -0,0 +1,85 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package syncerservice + +import ( + "testing" + + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" + networkingv1 "k8s.io/api/networking/v1" +) + +func TestConstants(t *testing.T) { + if syncerServiceCustomSet != "syncer-service-network-policies" { + t.Errorf("expected custom set syncer-service-network-policies, got %q", syncerServiceCustomSet) + } +} + +func TestSyncerServiceDefaultPolicies(t *testing.T) { + params := networkpolicy.OpenShiftPlatformDefaults() + policies := syncerServiceDefaultPolicies(params) + + if len(policies) != 1 { + t.Fatalf("expected 1 policy, got %d", len(policies)) + } + p := policies[0] + + if p.Name != "syncer-service-controller" { + t.Errorf("expected name syncer-service-controller, got %q", p.Name) + } + + labels := p.Spec.PodSelector.MatchLabels + if labels["app"] != "workload-controller" { + t.Errorf("expected app=workload-controller, got %q", labels["app"]) + } + + // Egress-only: no ingress rules + if len(p.Spec.PolicyTypes) != 1 { + t.Fatalf("expected 1 policy type (Egress only), got %d", len(p.Spec.PolicyTypes)) + } + if p.Spec.PolicyTypes[0] != networkingv1.PolicyTypeEgress { + t.Errorf("expected PolicyTypeEgress, got %v", p.Spec.PolicyTypes[0]) + } + if len(p.Spec.Ingress) != 0 { + t.Errorf("expected no ingress rules, got %d", len(p.Spec.Ingress)) + } + + // Egress: DNS + API server + if len(p.Spec.Egress) != 2 { + t.Fatalf("expected 2 egress rules (DNS + API server), got %d", len(p.Spec.Egress)) + } + + // Verify OpenShift DNS port 5353 + egressDNS := p.Spec.Egress[0] + if len(egressDNS.Ports) < 1 { + t.Fatal("expected DNS egress ports") + } + if egressDNS.Ports[0].Port.IntVal != 5353 { + t.Errorf("expected OpenShift DNS port 5353, got %d", egressDNS.Ports[0].Port.IntVal) + } +} + +func TestSyncerServiceDefaultDenyPolicy(t *testing.T) { + p := syncerServiceDefaultDenyPolicy() + + if p.Name != "syncer-service-default-deny" { + t.Errorf("expected name syncer-service-default-deny, got %q", p.Name) + } + if p.Spec.PodSelector.MatchLabels["app"] != "workload-controller" { + t.Errorf("expected deny scoped to app=workload-controller, got %v", p.Spec.PodSelector.MatchLabels) + } +} diff --git a/pkg/reconciler/openshift/syncerservice/reconcile.go b/pkg/reconciler/openshift/syncerservice/reconcile.go index 9ffb892114..c2ba23e995 100644 --- a/pkg/reconciler/openshift/syncerservice/reconcile.go +++ b/pkg/reconciler/openshift/syncerservice/reconcile.go @@ -27,6 +27,7 @@ import ( operatorv1alpha1 "github.com/tektoncd/operator/pkg/client/informers/externalversions/operator/v1alpha1" syncerservicereconciler "github.com/tektoncd/operator/pkg/client/injection/reconciler/operator/v1alpha1/syncerservice" "github.com/tektoncd/operator/pkg/reconciler/common" + "github.com/tektoncd/operator/pkg/reconciler/common/networkpolicy" "github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client" "k8s.io/client-go/kubernetes" "knative.dev/pkg/logging" @@ -40,6 +41,7 @@ type Reconciler struct { installerSetClient *client.InstallerSetClient manifest mf.Manifest extension common.Extension + platformParams networkpolicy.PlatformParams pipelineInformer operatorv1alpha1.TektonPipelineInformer operatorVersion string syncerVersion string @@ -112,6 +114,16 @@ func (r *Reconciler) ReconcileKind(ctx context.Context, ss *v1alpha1.SyncerServi return err } + if err := r.reconcileNetworkPolicies(ctx, ss); err != nil { + if err == v1alpha1.REQUEUE_EVENT_AFTER { + return err + } + msg := fmt.Sprintf("NetworkPolicy reconciliation failed: %s", err.Error()) + logger.Errorw("NetworkPolicy reconciliation failed", "error", err) + ss.Status.MarkInstallerSetNotReady(msg) + return nil + } + if err := r.extension.PostReconcile(ctx, ss); err != nil { if err == v1alpha1.REQUEUE_EVENT_AFTER { return err diff --git a/pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae.go b/pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae.go index f507ef406f..29724d94b7 100644 --- a/pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae.go +++ b/pkg/reconciler/shared/tektonconfig/multiclusterproxyaae/multiclusterproxyaae.go @@ -119,6 +119,7 @@ func GetTektonMulticlusterProxyAAECR(config *v1alpha1.TektonConfig, operatorVers TargetNamespace: config.Spec.TargetNamespace, }, MulticlusterProxyAAEOptions: config.Spec.MulticlusterProxyAAE, + NetworkPolicy: config.Spec.NetworkPolicy, }, } } @@ -148,6 +149,10 @@ func UpdateTektonMulticlusterProxyAAE(ctx context.Context, old, new *v1alpha1.Te old.Spec.Options = new.Spec.Options updated = true } + if !reflect.DeepEqual(old.Spec.NetworkPolicy, new.Spec.NetworkPolicy) { + old.Spec.NetworkPolicy = new.Spec.NetworkPolicy + updated = true + } if old.ObjectMeta.OwnerReferences == nil { old.ObjectMeta.OwnerReferences = new.ObjectMeta.OwnerReferences updated = true diff --git a/pkg/reconciler/shared/tektonconfig/scheduler/scheduler.go b/pkg/reconciler/shared/tektonconfig/scheduler/scheduler.go index f4b12f7123..726f6ef08c 100644 --- a/pkg/reconciler/shared/tektonconfig/scheduler/scheduler.go +++ b/pkg/reconciler/shared/tektonconfig/scheduler/scheduler.go @@ -36,7 +36,6 @@ const ( ) func EnsureTektonSchedulerExists(ctx context.Context, clients op.TektonSchedulerInterface, newScheduler *v1alpha1.TektonScheduler) (*v1alpha1.TektonScheduler, error) { - // Update MultiKueueOverride // If MultiCluster is enabled and MultiClusterRole=Hub then MultiKueueOverride should be true newScheduler.Spec.Config.MultiKueueOverride = !newScheduler.Spec.MultiClusterDisabled && strings.EqualFold(string(newScheduler.Spec.MultiClusterRole), string(v1alpha1.MultiClusterRoleHub)) @@ -86,7 +85,8 @@ func GetTektonSchedulerCR(config *v1alpha1.TektonConfig, operatorVersion string) CommonSpec: v1alpha1.CommonSpec{ TargetNamespace: config.Spec.TargetNamespace, }, - Scheduler: config.Spec.Scheduler, + Scheduler: config.Spec.Scheduler, + NetworkPolicy: config.Spec.NetworkPolicy, }, } } @@ -129,6 +129,11 @@ func UpdateScheduler(ctx context.Context, old *v1alpha1.TektonScheduler, new *v1 updated = true } + if !reflect.DeepEqual(old.Spec.NetworkPolicy, new.Spec.NetworkPolicy) { + old.Spec.NetworkPolicy = new.Spec.NetworkPolicy + updated = true + } + if old.ObjectMeta.OwnerReferences == nil { old.ObjectMeta.OwnerReferences = new.ObjectMeta.OwnerReferences updated = true diff --git a/pkg/reconciler/shared/tektonconfig/syncerservice/syncerservice.go b/pkg/reconciler/shared/tektonconfig/syncerservice/syncerservice.go index 156967f838..f4230e5a4f 100644 --- a/pkg/reconciler/shared/tektonconfig/syncerservice/syncerservice.go +++ b/pkg/reconciler/shared/tektonconfig/syncerservice/syncerservice.go @@ -137,6 +137,11 @@ func UpdateSyncerService(ctx context.Context, old *v1alpha1.SyncerService, new * updated = true } + if !reflect.DeepEqual(old.Spec.NetworkPolicy, new.Spec.NetworkPolicy) { + old.Spec.NetworkPolicy = new.Spec.NetworkPolicy + updated = true + } + if old.ObjectMeta.OwnerReferences == nil { old.ObjectMeta.OwnerReferences = new.ObjectMeta.OwnerReferences updated = true @@ -174,7 +179,8 @@ func GetSyncerServiceCR(config *v1alpha1.TektonConfig, operatorVersion string) * CommonSpec: v1alpha1.CommonSpec{ TargetNamespace: config.Spec.TargetNamespace, }, - Config: config.Spec.Config, + Config: config.Spec.Config, + NetworkPolicy: config.Spec.NetworkPolicy, }, } } diff --git a/test/e2e/common/12_syncerservice_networkpolicy_test.go b/test/e2e/common/12_syncerservice_networkpolicy_test.go new file mode 100644 index 0000000000..b904859cda --- /dev/null +++ b/test/e2e/common/12_syncerservice_networkpolicy_test.go @@ -0,0 +1,112 @@ +//go:build e2e +// +build e2e + +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package common + +import ( + "context" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/test/client" + "github.com/tektoncd/operator/test/resources" + "github.com/tektoncd/operator/test/utils" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func TestSyncerServiceNetworkPolicy(t *testing.T) { + crNames := utils.GetResourceNames() + clients := client.Setup(t, crNames.TargetNamespace) + + if !utils.IsOpenShift() { + t.Skip("MultiCluster components are OpenShift-only, skipping") + } + if _, err := clients.KubeClientSet.Discovery().ServerResourcesForGroupVersion("kueue.x-k8s.io/v1beta1"); err != nil { + t.Skipf("Kueue API (kueue.x-k8s.io/v1beta1) not available, skipping: %v", err) + } + + utils.CleanupOnInterrupt(func() { utils.TearDownSyncerService(clients, crNames.SyncerService) }) + utils.CleanupOnInterrupt(func() { utils.TearDownScheduler(clients, crNames.TektonScheduler) }) + defer utils.TearDownSyncerService(clients, crNames.SyncerService) + defer utils.TearDownScheduler(clients, crNames.TektonScheduler) + + utils.CleanupOnInterrupt(func() { resources.DeleteDummyWorkerCluster(clients) }) + defer resources.DeleteDummyWorkerCluster(clients) + + resources.EnsureNoTektonConfigInstance(t, clients, crNames) + + if _, err := clients.TektonConfig().Create(context.TODO(), &v1alpha1.TektonConfig{ + ObjectMeta: metav1.ObjectMeta{Name: crNames.TektonConfig}, + Spec: v1alpha1.TektonConfigSpec{ + Profile: v1alpha1.ProfileAll, + CommonSpec: v1alpha1.CommonSpec{TargetNamespace: crNames.TargetNamespace}, + Scheduler: v1alpha1.Scheduler{ + Disabled: ptr.To(false), + MultiClusterConfig: v1alpha1.MultiClusterConfig{ + MultiClusterDisabled: false, + MultiClusterRole: v1alpha1.MultiClusterRoleHub, + }, + }, + }, + }, metav1.CreateOptions{}); err != nil { + t.Fatalf("TektonConfig %q failed to create: %v", crNames.TektonConfig, err) + } + + resources.EnsureDummyWorkerCluster(t, clients) + + resources.AssertTektonConfigCRReadyStatus(t, clients, crNames) + resources.AssertTektonSchedulerCRReadyStatus(t, clients, crNames) + resources.AssertSyncerServiceCRReadyStatus(t, clients, crNames) + + expectedPolicies := []string{ + "syncer-service-default-deny", + "syncer-service-controller", + } + + t.Run("default-policies-created", func(t *testing.T) { + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("disable-removes-policies", func(t *testing.T) { + ss, err := clients.SyncerServices().Get(context.TODO(), crNames.SyncerService, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get SyncerService: %v", err) + } + ss.Spec.NetworkPolicy.Disabled = true + if _, err := clients.SyncerServices().Update(context.TODO(), ss, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to disable NetworkPolicy on SyncerService: %v", err) + } + resources.AssertSyncerServiceCRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesAbsent(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("reenable-restores-policies", func(t *testing.T) { + ss, err := clients.SyncerServices().Get(context.TODO(), crNames.SyncerService, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get SyncerService: %v", err) + } + ss.Spec.NetworkPolicy.Disabled = false + if _, err := clients.SyncerServices().Update(context.TODO(), ss, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to re-enable NetworkPolicy on SyncerService: %v", err) + } + resources.AssertSyncerServiceCRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) +} diff --git a/test/e2e/common/12_tektonmulticlusterproxyaae_networkpolicy_test.go b/test/e2e/common/12_tektonmulticlusterproxyaae_networkpolicy_test.go new file mode 100644 index 0000000000..f6445956fa --- /dev/null +++ b/test/e2e/common/12_tektonmulticlusterproxyaae_networkpolicy_test.go @@ -0,0 +1,112 @@ +//go:build e2e +// +build e2e + +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package common + +import ( + "context" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/test/client" + "github.com/tektoncd/operator/test/resources" + "github.com/tektoncd/operator/test/utils" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func TestTektonMulticlusterProxyAAENetworkPolicy(t *testing.T) { + crNames := utils.GetResourceNames() + clients := client.Setup(t, crNames.TargetNamespace) + + if !utils.IsOpenShift() { + t.Skip("MultiCluster components are OpenShift-only, skipping") + } + if _, err := clients.KubeClientSet.Discovery().ServerResourcesForGroupVersion("kueue.x-k8s.io/v1beta1"); err != nil { + t.Skipf("Kueue API (kueue.x-k8s.io/v1beta1) not available, skipping: %v", err) + } + + utils.CleanupOnInterrupt(func() { utils.TearDownMulticlusterProxyAAE(clients, crNames.TektonMulticlusterProxyAAE) }) + utils.CleanupOnInterrupt(func() { utils.TearDownScheduler(clients, crNames.TektonScheduler) }) + defer utils.TearDownMulticlusterProxyAAE(clients, crNames.TektonMulticlusterProxyAAE) + defer utils.TearDownScheduler(clients, crNames.TektonScheduler) + + utils.CleanupOnInterrupt(func() { resources.DeleteDummyWorkerCluster(clients) }) + defer resources.DeleteDummyWorkerCluster(clients) + + resources.EnsureNoTektonConfigInstance(t, clients, crNames) + + if _, err := clients.TektonConfig().Create(context.TODO(), &v1alpha1.TektonConfig{ + ObjectMeta: metav1.ObjectMeta{Name: crNames.TektonConfig}, + Spec: v1alpha1.TektonConfigSpec{ + Profile: v1alpha1.ProfileAll, + CommonSpec: v1alpha1.CommonSpec{TargetNamespace: crNames.TargetNamespace}, + Scheduler: v1alpha1.Scheduler{ + Disabled: ptr.To(false), + MultiClusterConfig: v1alpha1.MultiClusterConfig{ + MultiClusterDisabled: false, + MultiClusterRole: v1alpha1.MultiClusterRoleHub, + }, + }, + }, + }, metav1.CreateOptions{}); err != nil { + t.Fatalf("TektonConfig %q failed to create: %v", crNames.TektonConfig, err) + } + + resources.EnsureDummyWorkerCluster(t, clients) + + resources.AssertTektonConfigCRReadyStatus(t, clients, crNames) + resources.AssertTektonSchedulerCRReadyStatus(t, clients, crNames) + resources.AssertTektonMulticlusterProxyAAECRReadyStatus(t, clients, crNames) + + expectedPolicies := []string{ + "proxy-aae-default-deny", + "proxy-aae", + } + + t.Run("default-policies-created", func(t *testing.T) { + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("disable-removes-policies", func(t *testing.T) { + proxy, err := clients.TektonMulticlusterProxyAAEs().Get(context.TODO(), crNames.TektonMulticlusterProxyAAE, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get TektonMulticlusterProxyAAE: %v", err) + } + proxy.Spec.NetworkPolicy.Disabled = true + if _, err := clients.TektonMulticlusterProxyAAEs().Update(context.TODO(), proxy, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to disable NetworkPolicy on TektonMulticlusterProxyAAE: %v", err) + } + resources.AssertTektonMulticlusterProxyAAECRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesAbsent(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("reenable-restores-policies", func(t *testing.T) { + proxy, err := clients.TektonMulticlusterProxyAAEs().Get(context.TODO(), crNames.TektonMulticlusterProxyAAE, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get TektonMulticlusterProxyAAE: %v", err) + } + proxy.Spec.NetworkPolicy.Disabled = false + if _, err := clients.TektonMulticlusterProxyAAEs().Update(context.TODO(), proxy, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to re-enable NetworkPolicy on TektonMulticlusterProxyAAE: %v", err) + } + resources.AssertTektonMulticlusterProxyAAECRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) +} diff --git a/test/e2e/common/12_tektonscheduler_networkpolicy_test.go b/test/e2e/common/12_tektonscheduler_networkpolicy_test.go new file mode 100644 index 0000000000..f62e940390 --- /dev/null +++ b/test/e2e/common/12_tektonscheduler_networkpolicy_test.go @@ -0,0 +1,111 @@ +//go:build e2e +// +build e2e + +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package common + +import ( + "context" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + "github.com/tektoncd/operator/test/client" + "github.com/tektoncd/operator/test/resources" + "github.com/tektoncd/operator/test/utils" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func TestTektonSchedulerNetworkPolicy(t *testing.T) { + crNames := utils.GetResourceNames() + clients := client.Setup(t, crNames.TargetNamespace) + + if !utils.IsOpenShift() { + t.Skip("MultiCluster components are OpenShift-only, skipping") + } + if _, err := clients.KubeClientSet.Discovery().ServerResourcesForGroupVersion("kueue.x-k8s.io/v1beta1"); err != nil { + t.Skipf("Kueue API (kueue.x-k8s.io/v1beta1) not available, skipping: %v", err) + } + + utils.CleanupOnInterrupt(func() { utils.TearDownScheduler(clients, crNames.TektonScheduler) }) + defer utils.TearDownScheduler(clients, crNames.TektonScheduler) + + utils.CleanupOnInterrupt(func() { resources.DeleteDummyWorkerCluster(clients) }) + defer resources.DeleteDummyWorkerCluster(clients) + + resources.EnsureNoTektonConfigInstance(t, clients, crNames) + + if _, err := clients.TektonConfig().Create(context.TODO(), &v1alpha1.TektonConfig{ + ObjectMeta: metav1.ObjectMeta{Name: crNames.TektonConfig}, + Spec: v1alpha1.TektonConfigSpec{ + Profile: v1alpha1.ProfileAll, + CommonSpec: v1alpha1.CommonSpec{TargetNamespace: crNames.TargetNamespace}, + Scheduler: v1alpha1.Scheduler{ + Disabled: ptr.To(false), + MultiClusterConfig: v1alpha1.MultiClusterConfig{ + MultiClusterDisabled: false, + MultiClusterRole: v1alpha1.MultiClusterRoleHub, + }, + }, + }, + }, metav1.CreateOptions{}); err != nil { + t.Fatalf("TektonConfig %q failed to create: %v", crNames.TektonConfig, err) + } + + resources.EnsureDummyWorkerCluster(t, clients) + + resources.AssertTektonConfigCRReadyStatus(t, clients, crNames) + resources.AssertTektonSchedulerCRReadyStatus(t, clients, crNames) + + expectedPolicies := []string{ + "scheduler-controller-default-deny", + "scheduler-webhook-default-deny", + "scheduler-controller", + "scheduler-webhook", + } + + t.Run("default-policies-created", func(t *testing.T) { + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("disable-removes-policies", func(t *testing.T) { + ts, err := clients.TektonSchedulers().Get(context.TODO(), crNames.TektonScheduler, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get TektonScheduler: %v", err) + } + ts.Spec.NetworkPolicy.Disabled = true + if _, err := clients.TektonSchedulers().Update(context.TODO(), ts, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to disable NetworkPolicy on TektonScheduler: %v", err) + } + resources.AssertTektonSchedulerCRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesAbsent(t, clients, crNames.TargetNamespace, expectedPolicies) + }) + + t.Run("reenable-restores-policies", func(t *testing.T) { + ts, err := clients.TektonSchedulers().Get(context.TODO(), crNames.TektonScheduler, metav1.GetOptions{}) + if err != nil { + t.Fatalf("failed to get TektonScheduler: %v", err) + } + ts.Spec.NetworkPolicy.Disabled = false + if _, err := clients.TektonSchedulers().Update(context.TODO(), ts, metav1.UpdateOptions{}); err != nil { + t.Fatalf("failed to re-enable NetworkPolicy on TektonScheduler: %v", err) + } + resources.AssertTektonSchedulerCRReadyStatus(t, clients, crNames) + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) + }) +} diff --git a/test/resources/multicluster_helpers.go b/test/resources/multicluster_helpers.go new file mode 100644 index 0000000000..716713bb78 --- /dev/null +++ b/test/resources/multicluster_helpers.go @@ -0,0 +1,161 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package resources + +import ( + "context" + "os" + "testing" + + "github.com/tektoncd/operator/test/utils" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime/schema" + "k8s.io/client-go/tools/clientcmd" + clientcmdapi "k8s.io/client-go/tools/clientcmd/api" +) + +const ( + dummyWorkerSecretName = "e2e-dummy-worker" + dummyWorkerClusterName = "e2e-dummy-worker" + kueueNamespaceK8s = "kueue-system" + kueueNamespaceOCP = "openshift-kueue-operator" +) + +var multiKueueClusterGVR = schema.GroupVersionResource{ + Group: "kueue.x-k8s.io", + Version: "v1beta2", + Resource: "multikueueclusters", +} + +// KueueNamespace returns the namespace where Kueue components run. +func KueueNamespace() string { + if utils.IsOpenShift() { + return kueueNamespaceOCP + } + return kueueNamespaceK8s +} + +// EnsureDummyWorkerCluster creates a self-referential kubeconfig secret and +// MultiKueueCluster CR so that proxy-aae can detect at least one worker +// cluster and pass its readiness probe (/ready). +func EnsureDummyWorkerCluster(t *testing.T, clients *utils.Clients) { + t.Helper() + + ns := KueueNamespace() + cfg := clients.Config + + // Resolve the cluster CA — Kueue rejects insecure-skip-tls-verify. + caData := cfg.CAData + if len(caData) == 0 && cfg.CAFile != "" { + var err error + caData, err = os.ReadFile(cfg.CAFile) + if err != nil { + t.Fatalf("failed to read CA file %s: %v", cfg.CAFile, err) + } + } + if len(caData) == 0 { + cm, err := clients.KubeClient.CoreV1().ConfigMaps(ns).Get( + context.TODO(), "kube-root-ca.crt", metav1.GetOptions{}, + ) + if err != nil { + t.Fatalf("failed to get kube-root-ca.crt ConfigMap in %s: %v", ns, err) + } + caData = []byte(cm.Data["ca.crt"]) + } + + cluster := clientcmdapi.NewCluster() + cluster.Server = cfg.Host + cluster.CertificateAuthorityData = caData + + authInfo := clientcmdapi.NewAuthInfo() + authInfo.Token = cfg.BearerToken + authInfo.ClientCertificateData = cfg.CertData + authInfo.ClientKeyData = cfg.KeyData + + kubeConfig := clientcmdapi.NewConfig() + kubeConfig.Clusters[dummyWorkerClusterName] = cluster + kubeConfig.AuthInfos[dummyWorkerClusterName] = authInfo + kubeConfig.Contexts[dummyWorkerClusterName] = &clientcmdapi.Context{ + Cluster: dummyWorkerClusterName, + AuthInfo: dummyWorkerClusterName, + } + kubeConfig.CurrentContext = dummyWorkerClusterName + + kubeconfigBytes, err := clientcmd.Write(*kubeConfig) + if err != nil { + t.Fatalf("failed to serialize dummy worker kubeconfig: %v", err) + } + + secret := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: dummyWorkerSecretName, + Namespace: ns, + }, + Type: corev1.SecretTypeOpaque, + Data: map[string][]byte{ + "kubeconfig": kubeconfigBytes, + }, + } + _, err = clients.KubeClient.CoreV1().Secrets(ns).Create(context.TODO(), secret, metav1.CreateOptions{}) + if err != nil && !errors.IsAlreadyExists(err) { + t.Fatalf("failed to create dummy worker secret in %s: %v", ns, err) + } + + mkc := &unstructured.Unstructured{ + Object: map[string]interface{}{ + "apiVersion": "kueue.x-k8s.io/v1beta2", + "kind": "MultiKueueCluster", + "metadata": map[string]interface{}{ + "name": dummyWorkerClusterName, + }, + "spec": map[string]interface{}{ + "clusterSource": map[string]interface{}{ + "kubeConfig": map[string]interface{}{ + "locationType": "Secret", + "location": dummyWorkerSecretName, + }, + }, + }, + }, + } + _, err = clients.Dynamic.Resource(multiKueueClusterGVR).Create(context.TODO(), mkc, metav1.CreateOptions{}) + if err != nil && !errors.IsAlreadyExists(err) { + t.Fatalf("failed to create MultiKueueCluster %s: %v", dummyWorkerClusterName, err) + } +} + +// DeleteDummyWorkerCluster removes the dummy worker secret and +// MultiKueueCluster created by EnsureDummyWorkerCluster. +func DeleteDummyWorkerCluster(clients *utils.Clients) { + if clients == nil { + return + } + if clients.Dynamic != nil { + _ = clients.Dynamic.Resource(multiKueueClusterGVR).Delete( + context.TODO(), dummyWorkerClusterName, metav1.DeleteOptions{}, + ) + } + if clients.KubeClient != nil { + ns := KueueNamespace() + _ = clients.KubeClient.CoreV1().Secrets(ns).Delete( + context.TODO(), dummyWorkerSecretName, metav1.DeleteOptions{}, + ) + } +} diff --git a/test/resources/syncerservices.go b/test/resources/syncerservices.go new file mode 100644 index 0000000000..db7a5fb950 --- /dev/null +++ b/test/resources/syncerservices.go @@ -0,0 +1,77 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package resources + +import ( + "context" + "fmt" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + typedv1alpha1 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1" + "github.com/tektoncd/operator/test/utils" + apierrs "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" + "knative.dev/pkg/test/logging" +) + +func EnsureSyncerServiceExists(clients typedv1alpha1.SyncerServiceInterface, names utils.ResourceNames) (*v1alpha1.SyncerService, error) { + ks, err := clients.Get(context.TODO(), names.SyncerService, metav1.GetOptions{}) + if apierrs.IsNotFound(err) { + ks := &v1alpha1.SyncerService{ + ObjectMeta: metav1.ObjectMeta{ + Name: names.SyncerService, + }, + Spec: v1alpha1.SyncerServiceSpec{ + CommonSpec: v1alpha1.CommonSpec{ + TargetNamespace: names.TargetNamespace, + }, + }, + } + return clients.Create(context.TODO(), ks, metav1.CreateOptions{}) + } + return ks, err +} + +func WaitForSyncerServiceState(clients typedv1alpha1.SyncerServiceInterface, name string, + inState func(s *v1alpha1.SyncerService, err error) (bool, error), +) (*v1alpha1.SyncerService, error) { + span := logging.GetEmitableSpan(context.Background(), fmt.Sprintf("WaitForSyncerServiceState/%s/%s", name, "SyncerServiceIsReady")) + defer span.End() + + var lastState *v1alpha1.SyncerService + waitErr := wait.PollUntilContextTimeout(context.TODO(), utils.Interval, utils.Timeout, true, func(ctx context.Context) (bool, error) { + lastState, err := clients.Get(context.TODO(), name, metav1.GetOptions{}) + return inState(lastState, err) + }) + + if waitErr != nil { + return lastState, fmt.Errorf("syncerservice %s is not in desired state, got: %+v: %w", name, lastState, waitErr) + } + return lastState, nil +} + +func IsSyncerServiceReady(s *v1alpha1.SyncerService, err error) (bool, error) { + return s.Status.IsReady(), err +} + +func AssertSyncerServiceCRReadyStatus(t *testing.T, clients *utils.Clients, names utils.ResourceNames) { + if _, err := WaitForSyncerServiceState(clients.SyncerServices(), names.SyncerService, IsSyncerServiceReady); err != nil { + t.Fatalf("SyncerServiceCR %q failed to get to the READY status: %v", names.SyncerService, err) + } +} diff --git a/test/resources/tektonmulticlusterproxyaaes.go b/test/resources/tektonmulticlusterproxyaaes.go new file mode 100644 index 0000000000..61e4df8223 --- /dev/null +++ b/test/resources/tektonmulticlusterproxyaaes.go @@ -0,0 +1,77 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package resources + +import ( + "context" + "fmt" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + typedv1alpha1 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1" + "github.com/tektoncd/operator/test/utils" + apierrs "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" + "knative.dev/pkg/test/logging" +) + +func EnsureTektonMulticlusterProxyAAEExists(clients typedv1alpha1.TektonMulticlusterProxyAAEInterface, names utils.ResourceNames) (*v1alpha1.TektonMulticlusterProxyAAE, error) { + ks, err := clients.Get(context.TODO(), names.TektonMulticlusterProxyAAE, metav1.GetOptions{}) + if apierrs.IsNotFound(err) { + ks := &v1alpha1.TektonMulticlusterProxyAAE{ + ObjectMeta: metav1.ObjectMeta{ + Name: names.TektonMulticlusterProxyAAE, + }, + Spec: v1alpha1.TektonMulticlusterProxyAAESpec{ + CommonSpec: v1alpha1.CommonSpec{ + TargetNamespace: names.TargetNamespace, + }, + }, + } + return clients.Create(context.TODO(), ks, metav1.CreateOptions{}) + } + return ks, err +} + +func WaitForTektonMulticlusterProxyAAEState(clients typedv1alpha1.TektonMulticlusterProxyAAEInterface, name string, + inState func(s *v1alpha1.TektonMulticlusterProxyAAE, err error) (bool, error), +) (*v1alpha1.TektonMulticlusterProxyAAE, error) { + span := logging.GetEmitableSpan(context.Background(), fmt.Sprintf("WaitForTektonMulticlusterProxyAAEState/%s/%s", name, "TektonMulticlusterProxyAAEIsReady")) + defer span.End() + + var lastState *v1alpha1.TektonMulticlusterProxyAAE + waitErr := wait.PollUntilContextTimeout(context.TODO(), utils.Interval, utils.Timeout, true, func(ctx context.Context) (bool, error) { + lastState, err := clients.Get(context.TODO(), name, metav1.GetOptions{}) + return inState(lastState, err) + }) + + if waitErr != nil { + return lastState, fmt.Errorf("tektonmulticlusterproxyaae %s is not in desired state, got: %+v: %w", name, lastState, waitErr) + } + return lastState, nil +} + +func IsTektonMulticlusterProxyAAEReady(s *v1alpha1.TektonMulticlusterProxyAAE, err error) (bool, error) { + return s.Status.IsReady(), err +} + +func AssertTektonMulticlusterProxyAAECRReadyStatus(t *testing.T, clients *utils.Clients, names utils.ResourceNames) { + if _, err := WaitForTektonMulticlusterProxyAAEState(clients.TektonMulticlusterProxyAAEs(), names.TektonMulticlusterProxyAAE, IsTektonMulticlusterProxyAAEReady); err != nil { + t.Fatalf("TektonMulticlusterProxyAAECR %q failed to get to the READY status: %v", names.TektonMulticlusterProxyAAE, err) + } +} diff --git a/test/resources/tektonschedulers.go b/test/resources/tektonschedulers.go new file mode 100644 index 0000000000..14fbf4f829 --- /dev/null +++ b/test/resources/tektonschedulers.go @@ -0,0 +1,84 @@ +/* +Copyright 2026 The Tekton Authors + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package resources + +import ( + "context" + "fmt" + "testing" + + "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" + typedv1alpha1 "github.com/tektoncd/operator/pkg/client/clientset/versioned/typed/operator/v1alpha1" + "github.com/tektoncd/operator/test/utils" + apierrs "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" + "k8s.io/utils/ptr" + "knative.dev/pkg/test/logging" +) + +func EnsureTektonSchedulerExists(clients typedv1alpha1.TektonSchedulerInterface, names utils.ResourceNames) (*v1alpha1.TektonScheduler, error) { + ks, err := clients.Get(context.TODO(), names.TektonScheduler, metav1.GetOptions{}) + if apierrs.IsNotFound(err) { + ks := &v1alpha1.TektonScheduler{ + ObjectMeta: metav1.ObjectMeta{ + Name: names.TektonScheduler, + }, + Spec: v1alpha1.TektonSchedulerSpec{ + CommonSpec: v1alpha1.CommonSpec{ + TargetNamespace: names.TargetNamespace, + }, + Scheduler: v1alpha1.Scheduler{ + Disabled: ptr.To(false), + MultiClusterConfig: v1alpha1.MultiClusterConfig{ + MultiClusterDisabled: true, + }, + }, + }, + } + return clients.Create(context.TODO(), ks, metav1.CreateOptions{}) + } + return ks, err +} + +func WaitForTektonSchedulerState(clients typedv1alpha1.TektonSchedulerInterface, name string, + inState func(s *v1alpha1.TektonScheduler, err error) (bool, error), +) (*v1alpha1.TektonScheduler, error) { + span := logging.GetEmitableSpan(context.Background(), fmt.Sprintf("WaitForTektonSchedulerState/%s/%s", name, "TektonSchedulerIsReady")) + defer span.End() + + var lastState *v1alpha1.TektonScheduler + waitErr := wait.PollUntilContextTimeout(context.TODO(), utils.Interval, utils.Timeout, true, func(ctx context.Context) (bool, error) { + lastState, err := clients.Get(context.TODO(), name, metav1.GetOptions{}) + return inState(lastState, err) + }) + + if waitErr != nil { + return lastState, fmt.Errorf("tektonscheduler %s is not in desired state, got: %+v: %w", name, lastState, waitErr) + } + return lastState, nil +} + +func IsTektonSchedulerReady(s *v1alpha1.TektonScheduler, err error) (bool, error) { + return s.Status.IsReady(), err +} + +func AssertTektonSchedulerCRReadyStatus(t *testing.T, clients *utils.Clients, names utils.ResourceNames) { + if _, err := WaitForTektonSchedulerState(clients.TektonSchedulers(), names.TektonScheduler, IsTektonSchedulerReady); err != nil { + t.Fatalf("TektonSchedulerCR %q failed to get to the READY status: %v", names.TektonScheduler, err) + } +} diff --git a/test/utils/cleanup.go b/test/utils/cleanup.go index 6ca063639d..90b93406ce 100644 --- a/test/utils/cleanup.go +++ b/test/utils/cleanup.go @@ -27,9 +27,11 @@ import ( "k8s.io/apimachinery/pkg/util/wait" ) -type crDeleteVerifier wait.ConditionFunc -type deploymentDeleteVerifier wait.ConditionFunc -type crGetFunc func(ctx context.Context) error +type ( + crDeleteVerifier wait.ConditionFunc + deploymentDeleteVerifier wait.ConditionFunc + crGetFunc func(ctx context.Context) error +) // CleanupOnInterrupt will execute the function cleanup if an interrupt signal is caught func CleanupOnInterrupt(cleanup func()) { @@ -169,7 +171,6 @@ func TearDownAddon(clients *Clients, name string) { if err != nil { fmt.Printf("error waiting from tearDown of TektonAddon resource, name: %s, error: %v", name, err) } - } // TearDownNamespace will delete created test Namespace @@ -204,7 +205,6 @@ func TearDownNamespace(clients *Clients, name string) { } return false, nil }) - if err != nil { fmt.Printf("error waiting from tearDown of Namespace resource, name: %s, error: %v", name, err) } @@ -336,6 +336,7 @@ func TearDownManualApprovalGate(clients *Clients, name string) { fmt.Printf("error waiting from tearDown of ManualApprovalGate resource, name: %s, error: %v", name, err) } } + func TearDownTektonPruner(clients *Clients, name string) { ctx := context.Background() if clients == nil || clients.Operator == nil { @@ -367,6 +368,99 @@ func TearDownTektonPruner(clients *Clients, name string) { } } +func TearDownScheduler(clients *Clients, name string) { + ctx := context.Background() + if clients == nil || clients.Operator == nil { + return + } + + ts, err := clients.TektonSchedulers().Get(ctx, name, metav1.GetOptions{}) + if err != nil { + if !errors.IsNotFound(err) { + fmt.Printf("error trying to get TektonScheduler instance during teardown, name: %s, error: %v", name, err) + } + return + } + targetNamespace := ts.Spec.TargetNamespace + + err = clients.TektonSchedulers().Delete(ctx, name, metav1.DeleteOptions{}) + if err != nil { + fmt.Printf("error trying to delete TektonScheduler during teardown, name: %s, error: %v", name, err) + return + } + crdf := newCRDeleteVerifier(ctx, func(ctx context.Context) error { + _, err := clients.TektonSchedulers().Get(ctx, name, metav1.GetOptions{}) + return err + }) + ddf := newDeploymentDeleteVerifier(ctx, clients, targetNamespace, TektonSchedulerDeploymentLabel) + err = waitUntilFullDeletion(crdf, ddf) + if err != nil { + fmt.Printf("error waiting from tearDown of TektonScheduler resource, name: %s, error: %v", name, err) + } +} + +func TearDownMulticlusterProxyAAE(clients *Clients, name string) { + ctx := context.Background() + if clients == nil || clients.Operator == nil { + return + } + + proxy, err := clients.TektonMulticlusterProxyAAEs().Get(ctx, name, metav1.GetOptions{}) + if err != nil { + if !errors.IsNotFound(err) { + fmt.Printf("error trying to get TektonMulticlusterProxyAAE instance during teardown, name: %s, error: %v", name, err) + } + return + } + targetNamespace := proxy.Spec.TargetNamespace + + err = clients.TektonMulticlusterProxyAAEs().Delete(ctx, name, metav1.DeleteOptions{}) + if err != nil { + fmt.Printf("error trying to delete TektonMulticlusterProxyAAE during teardown, name: %s, error: %v", name, err) + return + } + crdf := newCRDeleteVerifier(ctx, func(ctx context.Context) error { + _, err := clients.TektonMulticlusterProxyAAEs().Get(ctx, name, metav1.GetOptions{}) + return err + }) + ddf := newDeploymentDeleteVerifier(ctx, clients, targetNamespace, TektonMulticlusterProxyAAEDeploymentLabel) + err = waitUntilFullDeletion(crdf, ddf) + if err != nil { + fmt.Printf("error waiting from tearDown of TektonMulticlusterProxyAAE resource, name: %s, error: %v", name, err) + } +} + +func TearDownSyncerService(clients *Clients, name string) { + ctx := context.Background() + if clients == nil || clients.Operator == nil { + return + } + + ss, err := clients.SyncerServices().Get(ctx, name, metav1.GetOptions{}) + if err != nil { + if !errors.IsNotFound(err) { + fmt.Printf("error trying to get SyncerService instance during teardown, name: %s, error: %v", name, err) + } + return + } + targetNamespace := ss.Spec.TargetNamespace + + err = clients.SyncerServices().Delete(ctx, name, metav1.DeleteOptions{}) + if err != nil { + fmt.Printf("error trying to delete SyncerService during teardown, name: %s, error: %v", name, err) + return + } + crdf := newCRDeleteVerifier(ctx, func(ctx context.Context) error { + _, err := clients.SyncerServices().Get(ctx, name, metav1.GetOptions{}) + return err + }) + ddf := newDeploymentDeleteVerifier(ctx, clients, targetNamespace, SyncerServiceDeploymentLabel) + err = waitUntilFullDeletion(crdf, ddf) + if err != nil { + fmt.Printf("error waiting from tearDown of SyncerService resource, name: %s, error: %v", name, err) + } +} + func newCRDeleteVerifier(ctx context.Context, f crGetFunc) crDeleteVerifier { return func() (bool, error) { err := f(ctx) @@ -385,7 +479,6 @@ func newDeploymentDeleteVerifier(ctx context.Context, c *Clients, namespace, lab deployemnts, err := c.KubeClient.AppsV1().Deployments(namespace).List(ctx, metav1.ListOptions{ LabelSelector: labelSelector, }) - if err != nil { return false, err } diff --git a/test/utils/clients.go b/test/utils/clients.go index 3b13f9d79e..1144b9115c 100644 --- a/test/utils/clients.go +++ b/test/utils/clients.go @@ -89,7 +89,8 @@ func buildClientConfig(kubeConfigPath string, clusterName string) (*rest.Config, } return clientcmd.NewNonInteractiveDeferredLoadingClientConfig( &clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeConfigPath}, - &overrides).ClientConfig() + &overrides, + ).ClientConfig() } func newTektonOperatorAlphaClients(cfg *rest.Config) (operatorv1alpha1.OperatorV1alpha1Interface, error) { @@ -131,6 +132,7 @@ func (c *Clients) TektonDashboard() operatorv1alpha1.TektonDashboardInterface { func (c *Clients) TektonDashboardAll() operatorv1alpha1.TektonDashboardInterface { return c.Operator.TektonDashboards() } + func (c *Clients) TektonAddon() operatorv1alpha1.TektonAddonInterface { return c.Operator.TektonAddons() } @@ -162,9 +164,11 @@ func (c *Clients) TektonChains() operatorv1alpha1.TektonChainInterface { func (c *Clients) TektonChainsAll() operatorv1alpha1.TektonChainInterface { return c.Operator.TektonChains() } + func (c *Clients) TektonPruner() operatorv1alpha1.TektonPrunerInterface { return c.Operator.TektonPruners() } + func (c *Clients) TektonPrunerAll() operatorv1alpha1.TektonPrunerInterface { return c.Operator.TektonPruners() } @@ -188,3 +192,27 @@ func (c *Clients) TektonInstallerSetAll() operatorv1alpha1.TektonInstallerSetInt func (c *Clients) OpenShiftPipelinesAsCode() operatorv1alpha1.OpenShiftPipelinesAsCodeInterface { return c.Operator.OpenShiftPipelinesAsCodes() } + +func (c *Clients) TektonSchedulers() operatorv1alpha1.TektonSchedulerInterface { + return c.Operator.TektonSchedulers() +} + +func (c *Clients) TektonSchedulersAll() operatorv1alpha1.TektonSchedulerInterface { + return c.Operator.TektonSchedulers() +} + +func (c *Clients) TektonMulticlusterProxyAAEs() operatorv1alpha1.TektonMulticlusterProxyAAEInterface { + return c.Operator.TektonMulticlusterProxyAAEs() +} + +func (c *Clients) TektonMulticlusterProxyAAEsAll() operatorv1alpha1.TektonMulticlusterProxyAAEInterface { + return c.Operator.TektonMulticlusterProxyAAEs() +} + +func (c *Clients) SyncerServices() operatorv1alpha1.SyncerServiceInterface { + return c.Operator.SyncerServices() +} + +func (c *Clients) SyncerServicesAll() operatorv1alpha1.SyncerServiceInterface { + return c.Operator.SyncerServices() +} diff --git a/test/utils/e2e_flags.go b/test/utils/e2e_flags.go index 8c88afb46c..78448abdac 100644 --- a/test/utils/e2e_flags.go +++ b/test/utils/e2e_flags.go @@ -24,14 +24,17 @@ import ( ) var ( - TektonPipelineDeploymentLabel = labelString(v1alpha1.OperandTektoncdPipeline) - TektonTriggerDeploymentLabel = labelString(v1alpha1.OperandTektoncdTriggers) - TektonDashboardDeploymentLabel = labelString(v1alpha1.OperandTektoncdDashboard) - TektonChainDeploymentLabel = labelString(v1alpha1.OperandTektoncdChains) - TektonResultsDeploymentLabel = labelString(v1alpha1.OperandTektoncdResults) - ManualApprovalGateDeploymentLabel = labelString(v1alpha1.ManualApprovalGates) - TektonPrunerDeploymentLabel = labelString(v1alpha1.TektonPrunerResourceName) - TektonAddonDeploymentLabel = labelString(openshift.OperandOpenShiftPipelinesAddons) + TektonPipelineDeploymentLabel = labelString(v1alpha1.OperandTektoncdPipeline) + TektonTriggerDeploymentLabel = labelString(v1alpha1.OperandTektoncdTriggers) + TektonDashboardDeploymentLabel = labelString(v1alpha1.OperandTektoncdDashboard) + TektonChainDeploymentLabel = labelString(v1alpha1.OperandTektoncdChains) + TektonResultsDeploymentLabel = labelString(v1alpha1.OperandTektoncdResults) + ManualApprovalGateDeploymentLabel = labelString(v1alpha1.ManualApprovalGates) + TektonPrunerDeploymentLabel = labelString(v1alpha1.TektonPrunerResourceName) + TektonAddonDeploymentLabel = labelString(openshift.OperandOpenShiftPipelinesAddons) + TektonSchedulerDeploymentLabel = labelString(v1alpha1.TektonSchedulerResourceName) + TektonMulticlusterProxyAAEDeploymentLabel = labelString(v1alpha1.MultiClusterProxyAAEResourceName) + SyncerServiceDeploymentLabel = labelString(v1alpha1.OperandSyncerService) ) func labelString(operandName string) string { diff --git a/test/utils/names.go b/test/utils/names.go index 4a3603228b..0f6b384780 100644 --- a/test/utils/names.go +++ b/test/utils/names.go @@ -20,36 +20,42 @@ import "github.com/tektoncd/operator/pkg/apis/operator/v1alpha1" // ResourceNames holds names of various resources. type ResourceNames struct { - TektonPipeline string - TektonTrigger string - TektonDashboard string - TektonAddon string - TektonConfig string - TektonPruner string - TektonResult string - TektonChain string - Namespace string - TargetNamespace string - OperatorPodSelectorLabel string - OpenShiftPipelinesAsCode string - ManualApprovalGate string + TektonPipeline string + TektonTrigger string + TektonDashboard string + TektonAddon string + TektonConfig string + TektonPruner string + TektonResult string + TektonChain string + TektonScheduler string + TektonMulticlusterProxyAAE string + SyncerService string + Namespace string + TargetNamespace string + OperatorPodSelectorLabel string + OpenShiftPipelinesAsCode string + ManualApprovalGate string } func GetResourceNames() ResourceNames { resourceNames := ResourceNames{ - TektonConfig: v1alpha1.ConfigResourceName, - TektonPipeline: v1alpha1.PipelineResourceName, - TektonTrigger: v1alpha1.TriggerResourceName, - TektonDashboard: v1alpha1.DashboardResourceName, - TektonAddon: v1alpha1.AddonResourceName, - TektonPruner: v1alpha1.TektonPrunerResourceName, - TektonResult: v1alpha1.ResultResourceName, - TektonChain: v1alpha1.ChainResourceName, - ManualApprovalGate: v1alpha1.ManualApprovalGates, - OpenShiftPipelinesAsCode: v1alpha1.OpenShiftPipelinesAsCodeName, - Namespace: "tekton-operator", - TargetNamespace: "tekton-pipelines", - OperatorPodSelectorLabel: "name=tekton-operator", + TektonConfig: v1alpha1.ConfigResourceName, + TektonPipeline: v1alpha1.PipelineResourceName, + TektonTrigger: v1alpha1.TriggerResourceName, + TektonDashboard: v1alpha1.DashboardResourceName, + TektonAddon: v1alpha1.AddonResourceName, + TektonPruner: v1alpha1.TektonPrunerResourceName, + TektonResult: v1alpha1.ResultResourceName, + TektonChain: v1alpha1.ChainResourceName, + TektonScheduler: v1alpha1.TektonSchedulerResourceName, + TektonMulticlusterProxyAAE: v1alpha1.MultiClusterProxyAAEResourceName, + SyncerService: v1alpha1.SyncerServiceResourceName, + ManualApprovalGate: v1alpha1.ManualApprovalGates, + OpenShiftPipelinesAsCode: v1alpha1.OpenShiftPipelinesAsCodeName, + Namespace: "tekton-operator", + TargetNamespace: "tekton-pipelines", + OperatorPodSelectorLabel: "name=tekton-operator", } if IsOpenShift() { resourceNames.Namespace = "openshift-operators"