Documentation ¶
Overview ¶
Copyright (c) 2022 Tigera, Inc. All rights reserved.
Index ¶
- Constants
- Variables
- func ConvertStagedGlobalPolicyToEnforced(staged *StagedGlobalNetworkPolicy) (StagedAction, *GlobalNetworkPolicy)
- func ConvertStagedPolicyToEnforced(staged *StagedNetworkPolicy) (StagedAction, *NetworkPolicy)
- func RegisterDefaults(scheme *runtime.Scheme) error
- func Resource(resource string) schema.GroupResource
- type AWSSrcDstCheckOption
- type Action
- type AlertException
- type AlertExceptionList
- type AlertExceptionSpec
- type AlertExceptionStatus
- type AuditEventsSelection
- type AuditResource
- type AuditSummary
- type AuthenticationReview
- type AuthenticationReviewList
- type AuthenticationReviewStatus
- type AuthorizationReview
- type AuthorizationReviewList
- type AuthorizationReviewResourceAttributes
- type AuthorizationReviewSpec
- type AuthorizationReviewStatus
- type AuthorizedResourceGroup
- type AuthorizedResourceVerb
- type AuthorizedResourceVerbs
- type AutoHostEndpointConfig
- type BGPConfiguration
- type BGPConfigurationList
- type BGPConfigurationSpec
- type BGPDaemonState
- type BGPDaemonStatus
- type BGPFilter
- type BGPFilterAction
- type BGPFilterList
- type BGPFilterMatchOperator
- type BGPFilterMatchSource
- type BGPFilterRuleV4
- type BGPFilterRuleV6
- type BGPFilterSpec
- type BGPPassword
- type BGPPeer
- type BGPPeerList
- type BGPPeerSpec
- type BGPPeerType
- type BGPSessionState
- type BIRDGatewayMode
- type BPFConnectTimeLBType
- type BPFHostNetworkedNATType
- type BindMode
- type BlockAffinity
- type BlockAffinityList
- type BlockAffinitySpec
- type BlockAffinityState
- type CISBenchmarkFilter
- type CISBenchmarkNode
- type CISBenchmarkNodeSummary
- type CISBenchmarkParams
- type CISBenchmarkResult
- type CISBenchmarkResultCount
- type CISBenchmarkSectionResult
- type CISBenchmarkSelection
- type CISBenchmarkSummary
- type CalicoNodeAgentStatus
- type CalicoNodeBGPRouteStatus
- type CalicoNodeBGPStatus
- type CalicoNodePeer
- type CalicoNodeRoute
- type CalicoNodeRouteLearnedFrom
- type CalicoNodeRouteSourceType
- type CalicoNodeRouteType
- type CalicoNodeStatus
- type CalicoNodeStatusList
- type CalicoNodeStatusSpec
- type CalicoNodeStatusStatus
- type ClusterInformation
- type ClusterInformationList
- type ClusterInformationSpec
- type Community
- type CompletedReportJob
- type ControllersConfig
- type DNSPolicyMode
- type DPIActive
- type DPIErrorCondition
- type DPINode
- type DashboardData
- type DashboardLayout
- type DeepPacketInspection
- type DeepPacketInspectionList
- type DeepPacketInspectionSpec
- type DeepPacketInspectionStatus
- type DetectorParams
- type EgressGatewayPolicy
- type EgressGatewayPolicyDestinationSpec
- type EgressGatewayPolicyList
- type EgressGatewayPolicySpec
- type EgressGatewayRule
- type EgressGatewaySpec
- type EgressSpec
- type EncapMode
- type EndpointPort
- type EndpointsReportEndpoint
- type EndpointsReportFlow
- type EndpointsReportNamespace
- type EndpointsReportService
- type EndpointsSelection
- type EndpointsSummary
- type EntityRule
- type ErrorCondition
- type EtcdConfig
- type ExternalNetwork
- type ExternalNetworkList
- type ExternalNetworkSpec
- type FailureDetectionMode
- type FederatedServicesControllerConfig
- type FelixConfiguration
- type FelixConfigurationList
- type FelixConfigurationSpec
- type FloatingIPType
- type FlowEndpoint
- type GatewayPreferenceType
- type GlobalAlert
- type GlobalAlertList
- type GlobalAlertSpec
- type GlobalAlertStatus
- type GlobalAlertSubstitution
- type GlobalAlertTemplate
- type GlobalAlertTemplateList
- type GlobalAlertType
- type GlobalNetworkPolicy
- type GlobalNetworkPolicyList
- type GlobalNetworkPolicySpec
- type GlobalNetworkSet
- type GlobalNetworkSetList
- type GlobalNetworkSetSpec
- type GlobalNetworkSetSync
- type GlobalReport
- type GlobalReportList
- type GlobalReportType
- type GlobalReportTypeList
- type GlobalThreatFeed
- type GlobalThreatFeedList
- type GlobalThreatFeedSpec
- type GlobalThreatFeedStatus
- type HTTPHeader
- type HTTPHeaderSource
- type HTTPMatch
- type HTTPPath
- type HTTPPull
- type HealthTimeoutOverride
- type HostEndpoint
- type HostEndpointList
- type HostEndpointSpec
- type ICMPFields
- type IPAMConfiguration
- type IPAMConfigurationList
- type IPAMConfigurationSpec
- type IPIPConfiguration
- type IPIPMode
- type IPPool
- type IPPoolAllowedUse
- type IPPoolList
- type IPPoolSpec
- type IPReservation
- type IPReservationList
- type IPReservationSpec
- type IptablesBackend
- type KubeConfig
- type KubeControllersConfiguration
- type KubeControllersConfigurationList
- type KubeControllersConfigurationSpec
- type KubeControllersConfigurationStatus
- type LicenseKey
- type LicenseKeyList
- type LicenseKeySpec
- type LicenseKeyStatus
- type LicensePackageType
- type ManagedCluster
- type ManagedClusterList
- type ManagedClusterSpec
- type ManagedClusterStatus
- type ManagedClusterStatusCondition
- type ManagedClusterStatusType
- type ManagedClusterStatusValue
- type NamedSelector
- type NamesAndLabelsMatch
- type NamespaceControllerConfig
- type NetworkPolicy
- type NetworkPolicyList
- type NetworkPolicySpec
- type NetworkSet
- type NetworkSetList
- type NetworkSetSpec
- type NodeControllerConfig
- type NodeStatusClassType
- type OverlayRoutingMode
- type PacketCapture
- type PacketCaptureFile
- type PacketCaptureList
- type PacketCaptureRule
- type PacketCaptureSpec
- type PacketCaptureState
- type PacketCaptureStatus
- type PolicyControllerConfig
- type PolicyPerformanceHint
- type PolicyRecommendationNamespaceStatus
- type PolicyRecommendationScope
- type PolicyRecommendationScopeList
- type PolicyRecommendationScopeNamespaceSpec
- type PolicyRecommendationScopeSpec
- type PolicyRecommendationScopeStatus
- type PolicyRecommendationScopeStatusCondition
- type PolicyRecommendationScopeStatusType
- type PolicyRecommendationScopeStatusValue
- type PolicyType
- type Position
- type PrefixAdvertisement
- type Profile
- type ProfileList
- type ProfileSpec
- type ProtoPort
- type Pull
- type RemoteClusterConfiguration
- type RemoteClusterConfigurationList
- type RemoteClusterConfigurationSpec
- type RemoteClusterSyncOptions
- type ReportData
- type ReportJob
- type ReportSpec
- type ReportStatus
- type ReportTemplate
- type ReportTypeSpec
- type ResourceID
- type RestartMode
- type RouteTableIDRange
- type RouteTableRange
- type RouteTableRanges
- type Rule
- type RuleMetadata
- type SecurityEventWebhook
- type SecurityEventWebhookConfigVar
- type SecurityEventWebhookConfigVarSource
- type SecurityEventWebhookConsumer
- type SecurityEventWebhookList
- type SecurityEventWebhookSpec
- type SecurityEventWebhookState
- type ServiceAccountControllerConfig
- type ServiceAccountMatch
- type ServiceClusterIPBlock
- type ServiceExternalIPBlock
- type ServiceLoadBalancerIPBlock
- type ServiceMatch
- type SourceAddress
- type StagedAction
- type StagedGlobalNetworkPolicy
- type StagedGlobalNetworkPolicyList
- type StagedGlobalNetworkPolicySpec
- type StagedKubernetesNetworkPolicy
- type StagedKubernetesNetworkPolicyList
- type StagedKubernetesNetworkPolicySpec
- type StagedNetworkPolicy
- type StagedNetworkPolicyList
- type StagedNetworkPolicySpec
- type ThreatFeedContent
- type ThreatFeedFormat
- type ThreatFeedFormatCSV
- type ThreatFeedFormatJSON
- type ThreatFeedFormatNewlineDelimited
- type ThreatFeedMode
- type ThreatFeedType
- type Tier
- type TierList
- type TierSpec
- type UIDashboard
- type UIGraphLayer
- type UIGraphNode
- type UIGraphNodeView
- type UIGraphView
- type UISettings
- type UISettingsGroup
- type UISettingsGroupList
- type UISettingsGroupSpec
- type UISettingsList
- type UISettingsSpec
- type VXLANMode
- type WindowsManageFirewallRulesMode
- type WorkloadEndpointControllerConfig
Constants ¶
const ( KindAlertException = "AlertException" KindAlertExceptionList = "AlertExceptionList" )
const ( KindAuthenticationReview = "AuthenticationReview" KindAuthenticationReviewList = "AuthenticationReviewList" )
const ( KindAuthorizationReview = "AuthorizationReview" KindAuthorizationReviewList = "AuthorizationReviewList" )
const ( KindBGPConfiguration = "BGPConfiguration" KindBGPConfigurationList = "BGPConfigurationList" )
const ( KindBGPFilter = "BGPFilter" KindBGPFilterList = "BGPFilterList" )
const ( KindBGPPeer = "BGPPeer" KindBGPPeerList = "BGPPeerList" )
const ( KindBlockAffinity = "BlockAffinity" KindBlockAffinityList = "BlockAffinityList" )
const ( KindClusterInformation = "ClusterInformation" KindClusterInformationList = "ClusterInformationList" )
const ( // API group details for the Calico v3 API. Group = "projectcalico.org" VersionCurrent = "v3" GroupVersionCurrent = Group + "/" + VersionCurrent // AllNamespaces is used for client instantiation, either for when the namespace // will be specified in the resource request, or for List or Watch queries across // all namespaces. AllNamespaces = "" // AllNames is used for List or Watch queries to wildcard the name. AllNames = "" // Label used to denote the Kind. This is added to network sets by Calico and may be used for // label matches by Policy selectors. LabelKind = "projectcalico.org/kind" // Label used to denote the Name. This is added to network sets by Calico and may be used for // label matches by Policy selectors. LabelName = "projectcalico.org/name" // Label used to denote the Namespace. This is added to workload endpoints and network sets by // Calico and may be used for label matches by Policy selectors. LabelNamespace = "projectcalico.org/namespace" // Label used to denote the ServiceAccount. This is added to the workload endpoints by Calico // and may be used for label matches by Policy selectors. LabelServiceAccount = "projectcalico.org/serviceaccount" // Label used to denote the Orchestrator. This is added to the workload endpoints by an // orchestrator. LabelOrchestrator = "projectcalico.org/orchestrator" // Label used to denote the Network a WorkloadEndpoint belongs too. LabelNetwork = "projectcalico.org/network" // Label used to denote the Namespace the NetworkAttachmentDefinition for a WorkloadEndpoint belongs to. LabelNetworkNamespace = "projectcalico.org/network-namespace" // Label used to denote the inside pod interface for a WorkloadEndpoint. LabelNetworkInterface = "projectcalico.org/network-interface" // Known orchestrators. Orchestrators are not limited to this list. OrchestratorKubernetes = "k8s" OrchestratorCNI = "cni" OrchestratorDocker = "libnetwork" OrchestratorOpenStack = "openstack" // Label used to denote the Tier. This is added to policies by Calico so that label matches // can be made for tiers. LabelTier = "projectcalico.org/tier" // Some internally defined resource types that map directly onto the kubernetes resources. These are only // available through the backend client. KindK8sEndpoints = "K8sEndpoints" KindK8sService = "K8sService" KindK8sPod = "Pod" KindFlowPublic = "Public" KindFlowPrivate = "Private" // Enum options for enable/disable fields Enabled = "Enabled" Disabled = "Disabled" )
const ( KindDeepPacketInspection = "DeepPacketInspection" KindDeepPacketInspectionList = "DeepPacketInspectionList" )
const ( KindEgressGatewayPolicy = "EgressGatewayPolicy" KindEgressGatewayPolicyList = "EgressGatewayPolicyList" )
const ( KindExternalNetwork = "ExternalNetwork" KindExternalNetworkList = "ExternalNetworkList" )
const ( KindFelixConfiguration = "FelixConfiguration" KindFelixConfigurationList = "FelixConfigurationList" IptablesBackendLegacy = "Legacy" IptablesBackendNFTables = "NFT" IptablesBackendAuto = "Auto" )
const ( AWSSecondaryIPEnabled = "Enabled" AWSSecondaryIPDisabled = "Disabled" AWSSecondaryIPEnabledENIPerWorkload = "EnabledENIPerWorkload" )
const ( KindGlobalAlert = "GlobalAlert" KindGlobalAlertList = "GlobalAlertList" GlobalAlertDataSetAudit = "audit" GlobalAlertDataSetDNS = "dns" GlobalAlertDataSetFlows = "flows" GlobalAlertDataSetL7 = "l7" GlobalAlertDataSetWAF = "waf" GlobalAlertDataSetVulnerability = "vulnerability" GlobalAlertMetricAvg = "avg" GlobalAlertMetricMax = "max" GlobalAlertMetrixMin = "min" GlobalAlertMetricSum = "sum" GlobalAlertMetricCount = "count" GlobalAlertMinPeriod = time.Minute GlobalAlertMinLookback = GlobalAlertMinPeriod )
const ( KindGlobalAlertTemplate = "GlobalAlertTemplate" KindGlobalAlertTemplateList = "GlobalAlertTemplateList" )
const ( KindGlobalNetworkPolicy = "GlobalNetworkPolicy" KindGlobalNetworkPolicyList = "GlobalNetworkPolicyList" )
const ( KindGlobalNetworkSet = "GlobalNetworkSet" KindGlobalNetworkSetList = "GlobalNetworkSetList" )
const ( KindGlobalReport = "GlobalReport" KindGlobalReportList = "GlobalReportList" )
const ( KindGlobalReportType = "GlobalReportType" KindGlobalReportTypeList = "GlobalReportTypeList" )
const ( KindGlobalThreatFeed = "GlobalThreatFeed" KindGlobalThreatFeedList = "GlobalThreatFeedList" DefaultPullPeriod = 24 * time.Hour MinPullPeriod = 5 * time.Minute MaxDescriptionLength = 256 SecretConfigMapNamePrefix = "globalthreatfeed" )
const ( KindHostEndpoint = "HostEndpoint" KindHostEndpointList = "HostEndpointList" )
const ( KindIPAMConfiguration = "IPAMConfiguration" KindIPAMConfigurationList = "IPAMConfigurationList" )
const ( KindIPPool = "IPPool" KindIPPoolList = "IPPoolList" )
const ( KindIPReservation = "IPReservation" KindIPReservationList = "IPReservationList" )
const ( KindKubeControllersConfiguration = "KubeControllersConfiguration" KindKubeControllersConfigurationList = "KubeControllersConfigurationList" )
const ( KindLicenseKey = "LicenseKey" KindLicenseKeyList = "LicenseKeyList" )
const ( KindManagedCluster = "ManagedCluster" KindManagedClusterList = "ManagedClusterList" )
const ( // Status for Type ManagedClusterConnected will be Unknown when ManagedCluster is created, // True when ManagedCluster is connected to ManagementCluster via tunnel, // False when the tunnel drops ManagedClusterStatusTypeConnected ManagedClusterStatusType = "ManagedClusterConnected" ManagedClusterStatusValueUnknown ManagedClusterStatusValue = "Unknown" ManagedClusterStatusValueTrue ManagedClusterStatusValue = "True" ManagedClusterStatusValueFalse ManagedClusterStatusValue = "False" )
const ( KindNetworkPolicy = "NetworkPolicy" KindNetworkPolicyList = "NetworkPolicyList" )
const ( KindNetworkSet = "NetworkSet" KindNetworkSetList = "NetworkSetList" )
const ( KindCalicoNodeStatus = "CalicoNodeStatus" KindCalicoNodeStatusList = "CalicoNodeStatusList" )
const ( KindPacketCapture = "PacketCapture" KindPacketCaptureList = "PacketCaptureList" )
const ( // PacketCaptureStateCapturing represents the active state of a PacketCapture of capturing traffic PacketCaptureStateCapturing PacketCaptureState = "Capturing" // PacketCaptureStateFinished represents the inactive state of a PacketCapture of not capturing traffic PacketCaptureStateFinished = "Finished" // PacketCaptureStateScheduled represents the inactive state of a PacketCapture of being // scheduled, but not capturing traffic PacketCaptureStateScheduled = "Scheduled" // PacketCaptureStateError represents the error state of a PacketCapture PacketCaptureStateError = "Error" // PacketCaptureStateWaitingForTraffic represents the active state of a PacketCapture of capturing from a live // interface, but waiting for traffic on that interface PacketCaptureStateWaitingForTraffic = "WaitingForTraffic" )
const ( KindPolicyRecommendationScope = "PolicyRecommendationScope" KindPolicyRecommendationScopeList = "PolicyRecommendationScopeList" )
const ( KindProfile = "Profile" KindProfileList = "ProfileList" )
const ( KindRemoteClusterConfiguration = "RemoteClusterConfiguration" KindRemoteClusterConfigurationList = "RemoteClusterConfigurationList" )
const ( KindSecurityEventWebhook = "SecurityEventWebhook" KindSecurityEventWebhookList = "SecurityEventWebhookList" SecurityEventWebhookConsumerSlack SecurityEventWebhookConsumer = "Slack" SecurityEventWebhookConsumerJira SecurityEventWebhookConsumer = "Jira" SecurityEventWebhookConsumerGeneric SecurityEventWebhookConsumer = "Generic" SecurityEventWebhookStateEnabled SecurityEventWebhookState = "Enabled" SecurityEventWebhookStateDisabled SecurityEventWebhookState = "Disabled" SecurityEventWebhookStateDebug SecurityEventWebhookState = "Debug" )
const ( KindStagedGlobalNetworkPolicy = "StagedGlobalNetworkPolicy" KindStagedGlobalNetworkPolicyList = "StagedGlobalNetworkPolicyList" )
const ( KindStagedKubernetesNetworkPolicy = "StagedKubernetesNetworkPolicy" KindStagedKubernetesNetworkPolicyList = "StagedKubernetesNetworkPolicyList" )
const ( KindStagedNetworkPolicy = "StagedNetworkPolicy" KindStagedNetworkPolicyList = "StagedNetworkPolicyList" )
const ( KindTier = "Tier" KindTierList = "TierList" )
const ( KindUISettings = "UISettings" KindUISettingsList = "UISettingsList" )
const ( KindUISettingsGroup = "UISettingsGroup" KindUISettingsGroupList = "UISettingsGroupList" )
const ( FilterTypeNone = "None" FilterTypeUser = "User" )
const DefaultCSVDelimiter = ','
const DefaultMode = Always
const GroupName = "projectcalico.org"
GroupName is the group name use in this package
Variables ¶
var ( SchemeBuilder runtime.SchemeBuilder AddToScheme = localSchemeBuilder.AddToScheme AllKnownTypes = []runtime.Object{ &NetworkPolicy{}, &NetworkPolicyList{}, &GlobalNetworkPolicy{}, &GlobalNetworkPolicyList{}, &GlobalNetworkSet{}, &GlobalNetworkSetList{}, &HostEndpoint{}, &HostEndpointList{}, &IPPool{}, &IPPoolList{}, &IPReservation{}, &IPReservationList{}, &BGPConfiguration{}, &BGPConfigurationList{}, &BGPFilter{}, &BGPFilterList{}, &BGPPeer{}, &BGPPeerList{}, &Profile{}, &ProfileList{}, &FelixConfiguration{}, &FelixConfigurationList{}, &KubeControllersConfiguration{}, &KubeControllersConfigurationList{}, &ClusterInformation{}, &ClusterInformationList{}, &NetworkSet{}, &NetworkSetList{}, &CalicoNodeStatus{}, &CalicoNodeStatusList{}, &IPAMConfiguration{}, &IPAMConfigurationList{}, &BlockAffinity{}, &BlockAffinityList{}, &AlertException{}, &AlertExceptionList{}, &AuthenticationReview{}, &AuthenticationReviewList{}, &AuthorizationReview{}, &AuthorizationReviewList{}, &DeepPacketInspection{}, &DeepPacketInspectionList{}, &EgressGatewayPolicy{}, &EgressGatewayPolicyList{}, &GlobalAlert{}, &GlobalAlertList{}, &GlobalAlertTemplate{}, &GlobalAlertTemplateList{}, &GlobalReport{}, &GlobalReportList{}, &GlobalReportType{}, &GlobalReportTypeList{}, &GlobalThreatFeed{}, &GlobalThreatFeedList{}, &LicenseKey{}, &LicenseKeyList{}, &ManagedCluster{}, &ManagedClusterList{}, &PacketCapture{}, &PacketCaptureList{}, &PolicyRecommendationScope{}, &PolicyRecommendationScopeList{}, &RemoteClusterConfiguration{}, &RemoteClusterConfigurationList{}, &StagedGlobalNetworkPolicy{}, &StagedGlobalNetworkPolicyList{}, &StagedKubernetesNetworkPolicy{}, &StagedKubernetesNetworkPolicyList{}, &StagedNetworkPolicy{}, &StagedNetworkPolicyList{}, &Tier{}, &TierList{}, &UISettingsGroup{}, &UISettingsGroupList{}, &UISettings{}, &UISettingsList{}, &ExternalNetwork{}, &ExternalNetworkList{}, &SecurityEventWebhook{}, &SecurityEventWebhookList{}, } )
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v3"}
SchemeGroupVersion is group version used to register these objects
var SchemeGroupVersionInternal = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
Functions ¶
func ConvertStagedGlobalPolicyToEnforced ¶
func ConvertStagedGlobalPolicyToEnforced(staged *StagedGlobalNetworkPolicy) (StagedAction, *GlobalNetworkPolicy)
ConvertStagedGlobalPolicyToEnforced converts a StagedGlobalNetworkPolicy into a StagedAction, GlobalNetworkPolicy pair
func ConvertStagedPolicyToEnforced ¶
func ConvertStagedPolicyToEnforced(staged *StagedNetworkPolicy) (StagedAction, *NetworkPolicy)
ConvertStagedPolicyToEnforced converts a StagedNetworkPolicy into a StagedAction, NetworkPolicy pair
func RegisterDefaults ¶
RegisterDefaults adds defaulters functions to the given scheme. Public to allow building arbitrary schemes. All generated defaulters are covering - they call all nested defaulters.
func Resource ¶
func Resource(resource string) schema.GroupResource
Resource takes an unqualified resource and returns a Group qualified GroupResource
Types ¶
type AWSSrcDstCheckOption ¶
type AWSSrcDstCheckOption string
+kubebuilder:validation:Enum=DoNothing;Enable;Disable
const ( AWSSrcDstCheckOptionDoNothing AWSSrcDstCheckOption = "DoNothing" AWSSrcDstCheckOptionEnable AWSSrcDstCheckOption = "Enable" AWSSrcDstCheckOptionDisable AWSSrcDstCheckOption = "Disable" )
type AlertException ¶
type AlertException struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` Spec AlertExceptionSpec `json:"spec,omitempty"` Status AlertExceptionStatus `json:"status,omitempty"` }
AlertException defines exceptions for alert events.
func NewAlertException ¶
func NewAlertException() *AlertException
func (*AlertException) DeepCopy ¶
func (in *AlertException) DeepCopy() *AlertException
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AlertException.
func (*AlertException) DeepCopyInto ¶
func (in *AlertException) DeepCopyInto(out *AlertException)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AlertException) DeepCopyObject ¶
func (in *AlertException) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AlertExceptionList ¶
type AlertExceptionList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []AlertException `json:"items"` }
AlertExceptionList contains a list of AlertException resources.
func NewAlertExceptionList ¶
func NewAlertExceptionList() *AlertExceptionList
func (*AlertExceptionList) DeepCopy ¶
func (in *AlertExceptionList) DeepCopy() *AlertExceptionList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AlertExceptionList.
func (*AlertExceptionList) DeepCopyInto ¶
func (in *AlertExceptionList) DeepCopyInto(out *AlertExceptionList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AlertExceptionList) DeepCopyObject ¶
func (in *AlertExceptionList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AlertExceptionSpec ¶
type AlertExceptionSpec struct { // The description is displayed by the UI. Description string `json:"description" validate:"required"` // Selector defines a query string for alert events to be excluded from UI search results. Selector string `json:"selector" validate:"required"` // StartTime defines the start time from which this alert exception will take effect. // If the value is in the past, matched alerts will be filtered immediately. // If the value is changed to a future time, alert exceptions will restart at that time. // +kubebuilder:validation:Format="date-time" StartTime metav1.Time `json:"startTime" validate:"required"` // EndTime defines the end time at which this alert exception will expire. // If omitted the alert exception filtering will continue indefinitely. // +optional //+kubebuilder:validation:Format="date-time" EndTime *metav1.Time `json:"endTime,omitempty" validate:"omitempty"` }
AlertExceptionSpec contains the specification for an alert exception resource.
func (*AlertExceptionSpec) DeepCopy ¶
func (in *AlertExceptionSpec) DeepCopy() *AlertExceptionSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AlertExceptionSpec.
func (*AlertExceptionSpec) DeepCopyInto ¶
func (in *AlertExceptionSpec) DeepCopyInto(out *AlertExceptionSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AlertExceptionStatus ¶
type AlertExceptionStatus struct { }
AlertExceptionStatus contains the status of an alert exception.
func (*AlertExceptionStatus) DeepCopy ¶
func (in *AlertExceptionStatus) DeepCopy() *AlertExceptionStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AlertExceptionStatus.
func (*AlertExceptionStatus) DeepCopyInto ¶
func (in *AlertExceptionStatus) DeepCopyInto(out *AlertExceptionStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuditEventsSelection ¶
type AuditEventsSelection struct { // Resources lists the resources that will be included in the audit logs in the ReportData. Blank fields in the // listed ResourceID structs are treated as wildcards. Resources []AuditResource `json:"resources,omitempty" validate:"omitempty"` }
AuditEventsSelection defines which set of resources should be audited.
func (*AuditEventsSelection) DeepCopy ¶
func (in *AuditEventsSelection) DeepCopy() *AuditEventsSelection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuditEventsSelection.
func (*AuditEventsSelection) DeepCopyInto ¶
func (in *AuditEventsSelection) DeepCopyInto(out *AuditEventsSelection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuditResource ¶
type AuditResource struct { // The resource type. The format is the lowercase plural as used in audit event selection and RBAC configuration. Resource string `json:"resource,omitempty" validate:"omitempty"` // APIGroup is the name of the API group that contains the referred object (e.g. projectcalico.org). APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"` // APIVersion is the version of the API group that contains the referred object (e.g. v3). APIVersion string `json:"apiVersion,omitempty" validate:"omitempty"` // The resource name. Name string `json:"name,omitempty" validate:"omitempty"` // The resource namespace. Namespace string `json:"namespace,omitempty" validate:"omitempty"` }
AuditResource is used to filter Audit events in the Report configuration.
An empty field value indicates a wildcard. For example, if Resource is set to "networkpolicies" and all other fields are blank then this filter would include all NetworkPolicy resources across all namespaces, and would include both Calico and Kubernetes resource types.
func (*AuditResource) DeepCopy ¶
func (in *AuditResource) DeepCopy() *AuditResource
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuditResource.
func (*AuditResource) DeepCopyInto ¶
func (in *AuditResource) DeepCopyInto(out *AuditResource)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (AuditResource) String ¶
func (resource AuditResource) String() (expanded string)
Prints AuditResource contents.
type AuditSummary ¶
type AuditSummary struct { // The total number of in-scope audit logs. NumTotal int `json:"numTotal,omitempty"` // The number of in-scope audit log create events. NumCreate int `json:"numCreate,omitempty"` // The number of in-scope audit log patch or replace events. NumModify int `json:"numModify,omitempty"` // The number of in-scope audit log delete events. NumDelete int `json:"numDelete,omitempty"` }
func (*AuditSummary) DeepCopy ¶
func (in *AuditSummary) DeepCopy() *AuditSummary
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuditSummary.
func (*AuditSummary) DeepCopyInto ¶
func (in *AuditSummary) DeepCopyInto(out *AuditSummary)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthenticationReview ¶
type AuthenticationReview struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Status AuthenticationReviewStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"` }
func NewAuthenticationReview ¶
func NewAuthenticationReview() *AuthenticationReview
New AuthenticationReview creates a new (zeroed) AuthenticationReview struct with the TypeMetadata initialized to the current version.
func (*AuthenticationReview) DeepCopy ¶
func (in *AuthenticationReview) DeepCopy() *AuthenticationReview
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationReview.
func (*AuthenticationReview) DeepCopyInto ¶
func (in *AuthenticationReview) DeepCopyInto(out *AuthenticationReview)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthenticationReview) DeepCopyObject ¶
func (in *AuthenticationReview) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthenticationReviewList ¶
type AuthenticationReviewList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []AuthenticationReview `json:"items" protobuf:"bytes,2,rep,name=items"` }
AuthenticationReviewList is a list of AuthenticationReview objects.
func (*AuthenticationReviewList) DeepCopy ¶
func (in *AuthenticationReviewList) DeepCopy() *AuthenticationReviewList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationReviewList.
func (*AuthenticationReviewList) DeepCopyInto ¶
func (in *AuthenticationReviewList) DeepCopyInto(out *AuthenticationReviewList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthenticationReviewList) DeepCopyObject ¶
func (in *AuthenticationReviewList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthenticationReviewStatus ¶
type AuthenticationReviewStatus struct { Name string `json:"name,omitempty" validate:"omitempty"` UID string `json:"uid,omitempty" validate:"omitempty"` Groups []string `json:"groups,omitempty" validate:"omitempty"` Extra map[string][]string `json:"extra,omitempty" validate:"omitempty"` }
func (*AuthenticationReviewStatus) DeepCopy ¶
func (in *AuthenticationReviewStatus) DeepCopy() *AuthenticationReviewStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationReviewStatus.
func (*AuthenticationReviewStatus) DeepCopyInto ¶
func (in *AuthenticationReviewStatus) DeepCopyInto(out *AuthenticationReviewStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizationReview ¶
type AuthorizationReview struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` Spec AuthorizationReviewSpec `json:"spec,omitempty"` Status AuthorizationReviewStatus `json:"status,omitempty"` }
func NewAuthorizationReview ¶
func NewAuthorizationReview() *AuthorizationReview
New AuthorizationReview creates a new (zeroed) AuthorizationReview struct with the TypeMetadata initialized to the current version.
func (*AuthorizationReview) DeepCopy ¶
func (in *AuthorizationReview) DeepCopy() *AuthorizationReview
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationReview.
func (*AuthorizationReview) DeepCopyInto ¶
func (in *AuthorizationReview) DeepCopyInto(out *AuthorizationReview)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthorizationReview) DeepCopyObject ¶
func (in *AuthorizationReview) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthorizationReviewList ¶
type AuthorizationReviewList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty"` Items []AuthorizationReview `json:"items"` }
AuthorizationReviewList is a list of AuthorizationReview objects.
func (*AuthorizationReviewList) DeepCopy ¶
func (in *AuthorizationReviewList) DeepCopy() *AuthorizationReviewList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationReviewList.
func (*AuthorizationReviewList) DeepCopyInto ¶
func (in *AuthorizationReviewList) DeepCopyInto(out *AuthorizationReviewList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*AuthorizationReviewList) DeepCopyObject ¶
func (in *AuthorizationReviewList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type AuthorizationReviewResourceAttributes ¶
type AuthorizationReviewResourceAttributes struct { // The API Group to check. APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"` // The set of resources to check within the same API Group. Resources []string `json:"resources,omitempty" validate:"omitempty"` // The set of verbs to check. This is expanded for each resource and within the same API Group. Verbs []string `json:"verbs,omitempty" validate:"omitempty"` }
func (*AuthorizationReviewResourceAttributes) DeepCopy ¶
func (in *AuthorizationReviewResourceAttributes) DeepCopy() *AuthorizationReviewResourceAttributes
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationReviewResourceAttributes.
func (*AuthorizationReviewResourceAttributes) DeepCopyInto ¶
func (in *AuthorizationReviewResourceAttributes) DeepCopyInto(out *AuthorizationReviewResourceAttributes)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizationReviewSpec ¶
type AuthorizationReviewSpec struct { // The set of resource attributes that are being checked. Each resource attribute is expanded into individual // kind/resource and verbs. ResourceAttributes []AuthorizationReviewResourceAttributes `json:"resourceAttributes,omitempty" validate:"omitempty"` }
func (*AuthorizationReviewSpec) DeepCopy ¶
func (in *AuthorizationReviewSpec) DeepCopy() *AuthorizationReviewSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationReviewSpec.
func (*AuthorizationReviewSpec) DeepCopyInto ¶
func (in *AuthorizationReviewSpec) DeepCopyInto(out *AuthorizationReviewSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizationReviewStatus ¶
type AuthorizationReviewStatus struct { // The set of authorized resource actions. A given API Group and resource combination will appear at most once in // this slice. AuthorizedResourceVerbs []AuthorizedResourceVerbs `json:"authorizedResourceVerbs,omitempty" validate:"omitempty"` }
func (*AuthorizationReviewStatus) DeepCopy ¶
func (in *AuthorizationReviewStatus) DeepCopy() *AuthorizationReviewStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationReviewStatus.
func (*AuthorizationReviewStatus) DeepCopyInto ¶
func (in *AuthorizationReviewStatus) DeepCopyInto(out *AuthorizationReviewStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizedResourceGroup ¶
type AuthorizedResourceGroup struct { // The tier. This is only valid for tiered policies, and tiers. Tier string `json:"tier,omitempty" validate:"omitempty"` // The namespace. If this is empty then the user is authorized cluster-wide (i.e. across all namespaces). This will // always be empty for cluster-scoped resources when the user is authorized. Namespace string `json:"namespace" validate:"omitempty"` // The UISettingsGroup name. This is only valid for uisettingsgroup/data sub resources. UISettingsGroup string `json:"uiSettingsGroup" validate:"omitempty"` // ManagedCluster is the name of the ManagedCluster. This is only valid for managedclusters. ManagedCluster string `json:"managedCluster" validate:"omitempty"` }
func (*AuthorizedResourceGroup) DeepCopy ¶
func (in *AuthorizedResourceGroup) DeepCopy() *AuthorizedResourceGroup
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizedResourceGroup.
func (*AuthorizedResourceGroup) DeepCopyInto ¶
func (in *AuthorizedResourceGroup) DeepCopyInto(out *AuthorizedResourceGroup)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizedResourceVerb ¶
type AuthorizedResourceVerb struct { // The verb. Verb string `json:"verb"` // The group of resource instances that are authorized for this verb. ResourceGroups []AuthorizedResourceGroup `json:"resourceGroups"` }
func (*AuthorizedResourceVerb) DeepCopy ¶
func (in *AuthorizedResourceVerb) DeepCopy() *AuthorizedResourceVerb
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizedResourceVerb.
func (*AuthorizedResourceVerb) DeepCopyInto ¶
func (in *AuthorizedResourceVerb) DeepCopyInto(out *AuthorizedResourceVerb)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AuthorizedResourceVerbs ¶
type AuthorizedResourceVerbs struct { // The API group. APIGroup string `json:"apiGroup,omitempty" validate:"omitempty"` // The resource. Resource string `json:"resource,omitempty" validate:"omitempty"` // The set of authorized actions for this resource. For a specific verb, this contains the set of resources for // which the user is authorized to perform that action. This is calculated to avoid duplication such that a single // resource instance can only be associated with a single entry in this slice. This allows a consumer of this API // to issue a minimal set of queries (e.g. watches) that cover, uniquely, the authorized set of resources. Verbs []AuthorizedResourceVerb `json:"verbs,omitempty" validate:"omitempty,dive"` }
func (*AuthorizedResourceVerbs) DeepCopy ¶
func (in *AuthorizedResourceVerbs) DeepCopy() *AuthorizedResourceVerbs
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizedResourceVerbs.
func (*AuthorizedResourceVerbs) DeepCopyInto ¶
func (in *AuthorizedResourceVerbs) DeepCopyInto(out *AuthorizedResourceVerbs)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type AutoHostEndpointConfig ¶
type AutoHostEndpointConfig struct { // AutoCreate enables automatic creation of host endpoints for every node. [Default: Disabled] AutoCreate string `json:"autoCreate,omitempty" validate:"omitempty,oneof=Enabled Disabled"` }
func (*AutoHostEndpointConfig) DeepCopy ¶
func (in *AutoHostEndpointConfig) DeepCopy() *AutoHostEndpointConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AutoHostEndpointConfig.
func (*AutoHostEndpointConfig) DeepCopyInto ¶
func (in *AutoHostEndpointConfig) DeepCopyInto(out *AutoHostEndpointConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPConfiguration ¶
type BGPConfiguration struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec BGPConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewBGPConfiguration ¶
func NewBGPConfiguration() *BGPConfiguration
New BGPConfiguration creates a new (zeroed) BGPConfiguration struct with the TypeMetadata initialized to the current version.
func (*BGPConfiguration) DeepCopy ¶
func (in *BGPConfiguration) DeepCopy() *BGPConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPConfiguration.
func (*BGPConfiguration) DeepCopyInto ¶
func (in *BGPConfiguration) DeepCopyInto(out *BGPConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPConfiguration) DeepCopyObject ¶
func (in *BGPConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPConfigurationList ¶
type BGPConfigurationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []BGPConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` }
BGPConfigurationList is a list of BGPConfiguration resources.
func (*BGPConfigurationList) DeepCopy ¶
func (in *BGPConfigurationList) DeepCopy() *BGPConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPConfigurationList.
func (*BGPConfigurationList) DeepCopyInto ¶
func (in *BGPConfigurationList) DeepCopyInto(out *BGPConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPConfigurationList) DeepCopyObject ¶
func (in *BGPConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPConfigurationSpec ¶
type BGPConfigurationSpec struct { // LogSeverityScreen is the log severity above which logs are sent to the stdout. [Default: INFO] LogSeverityScreen string `json:"logSeverityScreen,omitempty" validate:"omitempty,logLevel" confignamev1:"loglevel"` // NodeToNodeMeshEnabled sets whether full node to node BGP mesh is enabled. [Default: true] NodeToNodeMeshEnabled *bool `json:"nodeToNodeMeshEnabled,omitempty" validate:"omitempty" confignamev1:"node_mesh"` // ASNumber is the default AS number used by a node. [Default: 64512] ASNumber *numorstring.ASNumber `json:"asNumber,omitempty" validate:"omitempty" confignamev1:"as_num"` // Extensions is a mapping of keys to values that can be used in custom BGP templates Extensions map[string]string `json:"extensions,omitempty" validate:"omitempty" confignamev1:"extensions"` // ServiceLoadBalancerIPs are the CIDR blocks for Kubernetes Service LoadBalancer IPs. // Kubernetes Service status.LoadBalancer.Ingress IPs will only be advertised if they are within one of these blocks. ServiceLoadBalancerIPs []ServiceLoadBalancerIPBlock `json:"serviceLoadBalancerIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_loadbalancer_ips"` // ServiceExternalIPs are the CIDR blocks for Kubernetes Service External IPs. // Kubernetes Service ExternalIPs will only be advertised if they are within one of these blocks. ServiceExternalIPs []ServiceExternalIPBlock `json:"serviceExternalIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_external_ips"` // ServiceClusterIPs are the CIDR blocks from which service cluster IPs are allocated. // If specified, Calico will advertise these blocks, as well as any cluster IPs within them. ServiceClusterIPs []ServiceClusterIPBlock `json:"serviceClusterIPs,omitempty" validate:"omitempty,dive" confignamev1:"svc_cluster_ips"` // Communities is a list of BGP community values and their arbitrary names for tagging routes. Communities []Community `json:"communities,omitempty" validate:"omitempty,dive" confignamev1:"communities"` // PrefixAdvertisements contains per-prefix advertisement configuration. PrefixAdvertisements []PrefixAdvertisement `json:"prefixAdvertisements,omitempty" validate:"omitempty,dive" confignamev1:"prefix_advertisements"` // ListenPort is the port where BGP protocol should listen. Defaults to 179 // +kubebuilder:validation:Minimum:=1 // +kubebuilder:validation:Maximum:=65535 ListenPort uint16 `json:"listenPort,omitempty" validate:"omitempty,gt=0" confignamev1:"listen_port"` // Optional BGP password for full node-to-mesh peerings. // This field can only be set on the default BGPConfiguration instance and requires that NodeMesh is enabled // +optional NodeMeshPassword *BGPPassword `json:"nodeMeshPassword,omitempty" validate:"omitempty" confignamev1:"node_mesh_password"` // Time to allow for software restart for node-to-mesh peerings. When specified, this is configured // as the graceful restart timeout. When not specified, the BIRD default of 120s is used. // This field can only be set on the default BGPConfiguration instance and requires that NodeMesh is enabled // +optional NodeMeshMaxRestartTime *metav1.Duration `json:"nodeMeshMaxRestartTime,omitempty" confignamev1:"node_mesh_restart_time"` // BindMode indicates whether to listen for BGP connections on all addresses (None) // or only on the node's canonical IP address Node.Spec.BGP.IPvXAddress (NodeIP). // Default behaviour is to listen for BGP connections on all addresses. // +optional BindMode *BindMode `json:"bindMode,omitempty"` // IgnoredInterfaces indicates the network interfaces that needs to be excluded when reading device routes. // +optional IgnoredInterfaces []string `json:"ignoredInterfaces,omitempty" validate:"omitempty,dive,ignoredInterface"` }
BGPConfigurationSpec contains the values of the BGP configuration.
func (*BGPConfigurationSpec) DeepCopy ¶
func (in *BGPConfigurationSpec) DeepCopy() *BGPConfigurationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPConfigurationSpec.
func (*BGPConfigurationSpec) DeepCopyInto ¶
func (in *BGPConfigurationSpec) DeepCopyInto(out *BGPConfigurationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPDaemonState ¶
type BGPDaemonState string
const ( BGPDaemonStateReady BGPDaemonState = "Ready" BGPDaemonStateNotReady BGPDaemonState = "NotReady" )
type BGPDaemonStatus ¶
type BGPDaemonStatus struct { // The state of the BGP Daemon. State BGPDaemonState `json:"state,omitempty"` // Version of the BGP daemon Version string `json:"version,omitempty"` // Router ID used by bird. RouterID string `json:"routerID,omitempty"` // LastBootTime holds the value of lastBootTime from bird.ctl output. LastBootTime string `json:"lastBootTime,omitempty"` // LastReconfigurationTime holds the value of lastReconfigTime from bird.ctl output. LastReconfigurationTime string `json:"lastReconfigurationTime,omitempty"` }
BGPDaemonStatus defines the observed state of BGP daemon.
func (*BGPDaemonStatus) DeepCopy ¶
func (in *BGPDaemonStatus) DeepCopy() *BGPDaemonStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPDaemonStatus.
func (*BGPDaemonStatus) DeepCopyInto ¶
func (in *BGPDaemonStatus) DeepCopyInto(out *BGPDaemonStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPFilter ¶
type BGPFilter struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec BGPFilterSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewBGPFilter ¶
func NewBGPFilter() *BGPFilter
New BGPFilter creates a new (zeroed) BGPFilter struct with the TypeMetadata initialized to the current version.
func (*BGPFilter) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPFilter.
func (*BGPFilter) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPFilter) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPFilterAction ¶
type BGPFilterAction string
const ( Accept BGPFilterAction = "Accept" Reject BGPFilterAction = "Reject" )
type BGPFilterList ¶
type BGPFilterList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []BGPFilter `json:"items" protobuf:"bytes,2,rep,name=items"` }
BGPFilterList is a list of BGPFilter resources.
func (*BGPFilterList) DeepCopy ¶
func (in *BGPFilterList) DeepCopy() *BGPFilterList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPFilterList.
func (*BGPFilterList) DeepCopyInto ¶
func (in *BGPFilterList) DeepCopyInto(out *BGPFilterList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPFilterList) DeepCopyObject ¶
func (in *BGPFilterList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPFilterMatchOperator ¶
type BGPFilterMatchOperator string
const ( Equal BGPFilterMatchOperator = "Equal" NotEqual BGPFilterMatchOperator = "NotEqual" In BGPFilterMatchOperator = "In" NotIn BGPFilterMatchOperator = "NotIn" )
type BGPFilterMatchSource ¶
type BGPFilterMatchSource string
const (
BGPFilterSourceRemotePeers BGPFilterMatchSource = "RemotePeers"
)
type BGPFilterRuleV4 ¶
type BGPFilterRuleV4 struct { CIDR string `json:"cidr,omitempty" validate:"omitempty,netv4"` Source BGPFilterMatchSource `json:"source,omitempty" validate:"omitempty,oneof=RemotePeers"` Interface string `json:"interface,omitempty" validate:"omitempty,bgpFilterInterface"` MatchOperator BGPFilterMatchOperator `json:"matchOperator,omitempty" validate:"omitempty,matchOperator"` Action BGPFilterAction `json:"action" validate:"required,filterAction"` }
BGPFilterRuleV4 defines a BGP filter rule consisting a single IPv4 CIDR block and a filter action for this CIDR.
func (*BGPFilterRuleV4) DeepCopy ¶
func (in *BGPFilterRuleV4) DeepCopy() *BGPFilterRuleV4
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPFilterRuleV4.
func (*BGPFilterRuleV4) DeepCopyInto ¶
func (in *BGPFilterRuleV4) DeepCopyInto(out *BGPFilterRuleV4)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPFilterRuleV6 ¶
type BGPFilterRuleV6 struct { CIDR string `json:"cidr,omitempty" validate:"omitempty,netv6"` Source BGPFilterMatchSource `json:"source,omitempty" validate:"omitempty,oneof=RemotePeers"` Interface string `json:"interface,omitempty" validate:"omitempty,bgpFilterInterface"` MatchOperator BGPFilterMatchOperator `json:"matchOperator,omitempty" validate:"omitempty,matchOperator"` Action BGPFilterAction `json:"action" validate:"required,filterAction"` }
BGPFilterRuleV6 defines a BGP filter rule consisting a single IPv6 CIDR block and a filter action for this CIDR.
func (*BGPFilterRuleV6) DeepCopy ¶
func (in *BGPFilterRuleV6) DeepCopy() *BGPFilterRuleV6
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPFilterRuleV6.
func (*BGPFilterRuleV6) DeepCopyInto ¶
func (in *BGPFilterRuleV6) DeepCopyInto(out *BGPFilterRuleV6)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPFilterSpec ¶
type BGPFilterSpec struct { // The ordered set of IPv4 BGPFilter rules acting on exporting routes to a peer. ExportV4 []BGPFilterRuleV4 `json:"exportV4,omitempty" validate:"omitempty,dive"` // The ordered set of IPv4 BGPFilter rules acting on importing routes from a peer. ImportV4 []BGPFilterRuleV4 `json:"importV4,omitempty" validate:"omitempty,dive"` // The ordered set of IPv6 BGPFilter rules acting on exporting routes to a peer. ExportV6 []BGPFilterRuleV6 `json:"exportV6,omitempty" validate:"omitempty,dive"` // The ordered set of IPv6 BGPFilter rules acting on importing routes from a peer. ImportV6 []BGPFilterRuleV6 `json:"importV6,omitempty" validate:"omitempty,dive"` }
BGPFilterSpec contains the IPv4 and IPv6 filter rules of the BGP Filter.
func (*BGPFilterSpec) DeepCopy ¶
func (in *BGPFilterSpec) DeepCopy() *BGPFilterSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPFilterSpec.
func (*BGPFilterSpec) DeepCopyInto ¶
func (in *BGPFilterSpec) DeepCopyInto(out *BGPFilterSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPPassword ¶
type BGPPassword struct { // Selects a key of a secret in the node pod's namespace. SecretKeyRef *k8sv1.SecretKeySelector `json:"secretKeyRef,omitempty"` }
BGPPassword contains ways to specify a BGP password.
func (*BGPPassword) DeepCopy ¶
func (in *BGPPassword) DeepCopy() *BGPPassword
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPPassword.
func (*BGPPassword) DeepCopyInto ¶
func (in *BGPPassword) DeepCopyInto(out *BGPPassword)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPPeer ¶
type BGPPeer struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec BGPPeerSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewBGPPeer ¶
func NewBGPPeer() *BGPPeer
NewBGPPeer creates a new (zeroed) BGPPeer struct with the TypeMetadata initialised to the current version.
func (*BGPPeer) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPPeer.
func (*BGPPeer) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPPeer) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPPeerList ¶
type BGPPeerList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []BGPPeer `json:"items" protobuf:"bytes,2,rep,name=items"` }
BGPPeerList is a list of BGPPeer resources.
func (*BGPPeerList) DeepCopy ¶
func (in *BGPPeerList) DeepCopy() *BGPPeerList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPPeerList.
func (*BGPPeerList) DeepCopyInto ¶
func (in *BGPPeerList) DeepCopyInto(out *BGPPeerList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BGPPeerList) DeepCopyObject ¶
func (in *BGPPeerList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BGPPeerSpec ¶
type BGPPeerSpec struct { // The node name identifying the Calico node instance that is targeted by this peer. // If this is not set, and no nodeSelector is specified, then this BGP peer selects all // nodes in the cluster. // +optional Node string `json:"node,omitempty" validate:"omitempty,name"` // Selector for the nodes that should have this peering. When this is set, the Node // field must be empty. // +optional NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"` // The IP address of the peer followed by an optional port number to peer with. // If port number is given, format should be `[<IPv6>]:port` or `<IPv4>:<port>` for IPv4. // If optional port number is not set, and this peer IP and ASNumber belongs to a calico/node // with ListenPort set in BGPConfiguration, then we use that port to peer. // +optional PeerIP string `json:"peerIP,omitempty" validate:"omitempty,IP:port"` // The AS Number of the peer. // +optional ASNumber numorstring.ASNumber `json:"asNumber,omitempty"` // Extensions is a mapping of keys to values that can be used in custom BGP templates // +optional Extensions map[string]string `json:"extensions,omitempty" validate:"omitempty"` // Selector for the remote nodes to peer with. When this is set, the PeerIP and // ASNumber fields must be empty. For each peering between the local node and // selected remote nodes, we configure an IPv4 peering if both ends have // NodeBGPSpec.IPv4Address specified, and an IPv6 peering if both ends have // NodeBGPSpec.IPv6Address specified. The remote AS number comes from the remote // node's NodeBGPSpec.ASNumber, or the global default if that is not set. // +optional PeerSelector string `json:"peerSelector,omitempty" validate:"omitempty,selector"` // Option to keep the original nexthop field when routes are sent to a BGP Peer. // Setting "true" configures the selected BGP Peers node to use the "next hop keep;" // instead of "next hop self;"(default) in the specific branch of the Node on "bird.cfg". KeepOriginalNextHop bool `json:"keepOriginalNextHop,omitempty"` // Optional BGP password for the peerings generated by this BGPPeer resource. Password *BGPPassword `json:"password,omitempty" validate:"omitempty"` // Specifies whether and how to configure a source address for the peerings generated by // this BGPPeer resource. Default value "UseNodeIP" means to configure the node IP as the // source address. "None" means not to configure a source address. SourceAddress SourceAddress `json:"sourceAddress,omitempty" validate:"omitempty,sourceAddress"` // Specifies whether and how to detect loss of connectivity on the peerings generated by // this BGPPeer resource. Default value "None" means nothing beyond BGP's own (slow) hold // timer. "BFDIfDirectlyConnected" means to use BFD when the peer is directly connected. FailureDetectionMode FailureDetectionMode `json:"failureDetectionMode,omitempty" validate:"omitempty,failureDetectionMode"` // Specifies restart behaviour to configure on the peerings generated by this BGPPeer // resource. Default value "GracefulRestart" means traditional graceful restart. // "LongLivedGracefulRestart" means LLGR according to draft-uttaro-idr-bgp-persistence-05. RestartMode RestartMode `json:"restartMode,omitempty" validate:"omitempty,restartMode"` // Time to allow for software restart. When specified, this is configured as the graceful // restart timeout when RestartMode is "GracefulRestart", and as the LLGR stale time when // RestartMode is "LongLivedGracefulRestart". When not specified, the BIRD defaults are // used, which are 120s for "GracefulRestart" and 3600s for "LongLivedGracefulRestart". MaxRestartTime *metav1.Duration `json:"maxRestartTime,omitempty"` // Specifies the BIRD "gateway" mode, i.e. method for computing the immediate next hop for // each received route, for peerings generated by this BGPPeer resource. Default value // "Recursive" means "gateway recursive". "DirectIfDirectlyConnected" means to configure // "gateway direct" when the peer is directly connected. BIRDGatewayMode BIRDGatewayMode `json:"birdGatewayMode,omitempty" validate:"omitempty,birdGatewayMode"` // Maximum number of local AS numbers that are allowed in the AS path for received routes. // This removes BGP loop prevention and should only be used if absolutely necessary. // +optional NumAllowedLocalASNumbers *int32 `json:"numAllowedLocalASNumbers,omitempty"` // TTLSecurity enables the generalized TTL security mechanism (GTSM) which protects against spoofed packets by // ignoring received packets with a smaller than expected TTL value. The provided value is the number of hops // (edges) between the peers. // +optional TTLSecurity *uint8 `json:"ttlSecurity,omitempty"` // The ordered set of BGPFilters applied on this BGP peer. // +optional Filters []string `json:"filters,omitempty" validate:"omitempty,dive,name"` // Name of the external network to which this peer belongs. // +optional ExternalNetwork string `json:"externalNetwork,omitempty" validate:"omitempty,name"` // Add an exact, i.e. /32, static route toward peer IP in order to prevent route flapping. // ReachableBy contains the address of the gateway which peer can be reached by. // +optional ReachableBy string `json:"reachableBy,omitempty" validate:"omitempty,reachableBy"` }
BGPPeerSpec contains the specification for a BGPPeer resource.
func (*BGPPeerSpec) DeepCopy ¶
func (in *BGPPeerSpec) DeepCopy() *BGPPeerSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BGPPeerSpec.
func (*BGPPeerSpec) DeepCopyInto ¶
func (in *BGPPeerSpec) DeepCopyInto(out *BGPPeerSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BGPPeerType ¶
type BGPPeerType string
const ( BGPPeerTypeNodeMesh BGPPeerType = "NodeMesh" BGPPeerTypeNodePeer BGPPeerType = "NodePeer" BGPPeerTypeGlobalPeer BGPPeerType = "GlobalPeer" )
type BGPSessionState ¶
type BGPSessionState string
const ( BGPSessionStateIdle BGPSessionState = "Idle" BGPSessionStateConnect BGPSessionState = "Connect" BGPSessionStateActive BGPSessionState = "Active" BGPSessionStateOpenSent BGPSessionState = "OpenSent" BGPSessionStateOpenConfirm BGPSessionState = "OpenConfirm" BGPSessionStateEstablished BGPSessionState = "Established" BGPSessionStateClose BGPSessionState = "Close" )
type BIRDGatewayMode ¶
type BIRDGatewayMode string
const ( BIRDGatewayModeRecursive BIRDGatewayMode = "Recursive" BIRDGatewayModeDirectIfDirectlyConnected BIRDGatewayMode = "DirectIfDirectlyConnected" )
type BPFConnectTimeLBType ¶
type BPFConnectTimeLBType string
+kubebuilder:validation:Enum=TCP;Enabled;Disabled
const ( BPFConnectTimeLBTCP BPFConnectTimeLBType = "TCP" BPFConnectTimeLBEnabled BPFConnectTimeLBType = "Enabled" BPFConnectTimeLBDisabled BPFConnectTimeLBType = "Disabled" )
type BPFHostNetworkedNATType ¶
type BPFHostNetworkedNATType string
const ( BPFHostNetworkedNATEnabled BPFHostNetworkedNATType = "Enabled" BPFHostNetworkedNATDisabled BPFHostNetworkedNATType = "Disabled" )
type BlockAffinity ¶
type BlockAffinity struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the BlockAffinity. Spec BlockAffinitySpec `json:"spec,omitempty"` }
BlockAffinity maintains a block affinity's state
func NewBlockAffinity ¶
func NewBlockAffinity() *BlockAffinity
NewBlockAffinity creates a new (zeroed) BlockAffinity struct with the TypeMetadata initialised to the current version.
func (*BlockAffinity) DeepCopy ¶
func (in *BlockAffinity) DeepCopy() *BlockAffinity
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BlockAffinity.
func (*BlockAffinity) DeepCopyInto ¶
func (in *BlockAffinity) DeepCopyInto(out *BlockAffinity)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BlockAffinity) DeepCopyObject ¶
func (in *BlockAffinity) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BlockAffinityList ¶
type BlockAffinityList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []BlockAffinity `json:"items"` }
BlockAffinityList contains a list of BlockAffinity resources.
func NewBlockAffinityList ¶
func NewBlockAffinityList() *BlockAffinityList
NewBlockAffinityList creates a new (zeroed) BlockAffinityList struct with the TypeMetadata initialised to the current version.
func (*BlockAffinityList) DeepCopy ¶
func (in *BlockAffinityList) DeepCopy() *BlockAffinityList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BlockAffinityList.
func (*BlockAffinityList) DeepCopyInto ¶
func (in *BlockAffinityList) DeepCopyInto(out *BlockAffinityList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*BlockAffinityList) DeepCopyObject ¶
func (in *BlockAffinityList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type BlockAffinitySpec ¶
type BlockAffinitySpec struct { // The state of the block affinity with regard to any referenced IPAM blocks. State BlockAffinityState `json:"state"` // The node that this block affinity is assigned to. Node string `json:"node"` // The CIDR range this block affinity references. CIDR string `json:"cidr"` // Deleted indicates whether or not this block affinity is disabled and is // used as part of race-condition prevention. When set to true, clients // should treat this block as if it does not exist. Deleted bool `json:"deleted,omitempty"` }
BlockAffinitySpec contains the specification for a BlockAffinity resource.
func (*BlockAffinitySpec) DeepCopy ¶
func (in *BlockAffinitySpec) DeepCopy() *BlockAffinitySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BlockAffinitySpec.
func (*BlockAffinitySpec) DeepCopyInto ¶
func (in *BlockAffinitySpec) DeepCopyInto(out *BlockAffinitySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type BlockAffinityState ¶
type BlockAffinityState string
const ( StateConfirmed BlockAffinityState = "confirmed" StatePending BlockAffinityState = "pending" StatePendingDeletion BlockAffinityState = "pendingDeletion" )
type CISBenchmarkFilter ¶
type CISBenchmarkFilter struct { // BenchmarkSelection specifies which benchmarks this filter applies to. If not specified, applies to all. BenchmarkSelection *CISBenchmarkSelection `json:"benchmarkSelection,omitempty" validate:"omitempty"` // Exclude is an array of test indices to exclude from the report. Exclude []string `json:"exclude,omitempty"` // Include is an array of test indices to show in the report. // Is additive if IncludeUnscoredTests is true. // Takes precedence over Exclude. Include []string `json:"include,omitempty"` }
CISBenchmarkFilter provides filters for a set of benchmarks that match particular selection criteria.
func (*CISBenchmarkFilter) DeepCopy ¶
func (in *CISBenchmarkFilter) DeepCopy() *CISBenchmarkFilter
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkFilter.
func (*CISBenchmarkFilter) DeepCopyInto ¶
func (in *CISBenchmarkFilter) DeepCopyInto(out *CISBenchmarkFilter)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkNode ¶
type CISBenchmarkNode struct { // NodeName is the name of the node the this set of benchmark results is from. NodeName string `json:"nodeName"` // KubernetesVersion is the version of the kubelet running on this node. KubernetesVersion string `json:"kubernetesVersion"` // BenchmarksVersion is the version of the benchmarks that ran on this node. BenchmarksVersion string `json:"benchmarksVersion"` // Summary is a set of summary stats for this set of node-specific benchmarks. Summary CISBenchmarkNodeSummary `json:"summary"` // Results is the detailed set of results for this set of node-specific benchmarks. Results []CISBenchmarkSectionResult `json:"results"` }
CISBenchmarkNode describes a CIS benchmarking result on a single node.
func (*CISBenchmarkNode) DeepCopy ¶
func (in *CISBenchmarkNode) DeepCopy() *CISBenchmarkNode
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkNode.
func (*CISBenchmarkNode) DeepCopyInto ¶
func (in *CISBenchmarkNode) DeepCopyInto(out *CISBenchmarkNode)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkNodeSummary ¶
type CISBenchmarkNodeSummary struct { Status string `json:"status"` TotalPass int `json:"totalPass"` TotalFail int `json:"totalFail"` TotalInfo int `json:"totalInfo"` Total int `json:"total"` }
CISBenchmarkNodeSummary keeps count of tests passed, failed, and marked as info on a single node. Also has a status field to describe whether it is in HIGH, MED, or LOW status (based on [high|med]Threshold).
func (*CISBenchmarkNodeSummary) DeepCopy ¶
func (in *CISBenchmarkNodeSummary) DeepCopy() *CISBenchmarkNodeSummary
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkNodeSummary.
func (*CISBenchmarkNodeSummary) DeepCopyInto ¶
func (in *CISBenchmarkNodeSummary) DeepCopyInto(out *CISBenchmarkNodeSummary)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkParams ¶
type CISBenchmarkParams struct { // Specifies if the report should also show results for scored/not-scored tests. IncludeUnscoredTests bool `json:"includeUnscoredTests,omitempty"` // Configure the number of top failed tests to show up on the report. NumFailedTests *int `json:"numFailedTests,omitempty" validate:"gt=0"` // Benchmark results filters. The first matching set of filters is applied to each set of benchmark results. // If there are no matching filters, the full set of benchmark results will be included in the report. ResultsFilters []CISBenchmarkFilter `json:"resultsFilters,omitempty"` // Interpretted as a percentage to indicate at what levels of passing tests a node should be considered // HIGH, MED, and LOW. // - If >= HighThreshold flag as high // - Otherwise, if > MedThreshold flag as med // - Otherwise flag as low. HighThreshold *int `json:"highThreshold,omitempty" validate:"gte=0,lte=100,gtfield=MedThreshold"` MedThreshold *int `json:"medThreshold,omitempty" validate:"gte=0,lte=100"` }
CISBenchmarkParams contains the parameters for configuring a CIS benchmark report.
func (*CISBenchmarkParams) DeepCopy ¶
func (in *CISBenchmarkParams) DeepCopy() *CISBenchmarkParams
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkParams.
func (*CISBenchmarkParams) DeepCopyInto ¶
func (in *CISBenchmarkParams) DeepCopyInto(out *CISBenchmarkParams)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkResult ¶
type CISBenchmarkResult struct { TestNumber string `json:"testNumber"` TestDesc string `json:"testDesc"` TestInfo string `json:"testInfo"` Status string `json:"status"` Scored bool `json:"scored"` }
CISBenchmarkResult describes the result of a single CIS benchmark check.
func (*CISBenchmarkResult) DeepCopy ¶
func (in *CISBenchmarkResult) DeepCopy() *CISBenchmarkResult
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkResult.
func (*CISBenchmarkResult) DeepCopyInto ¶
func (in *CISBenchmarkResult) DeepCopyInto(out *CISBenchmarkResult)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkResultCount ¶
type CISBenchmarkResultCount struct { CISBenchmarkResult Count int `json:"count"` }
CISBenchmarkResultCount keeps track of how many nodes had a certain test result.
func (*CISBenchmarkResultCount) DeepCopy ¶
func (in *CISBenchmarkResultCount) DeepCopy() *CISBenchmarkResultCount
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkResultCount.
func (*CISBenchmarkResultCount) DeepCopyInto ¶
func (in *CISBenchmarkResultCount) DeepCopyInto(out *CISBenchmarkResultCount)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkSectionResult ¶
type CISBenchmarkSectionResult struct { Status string `json:"status"` Section string `json:"section"` Desc string `json:"desc"` Pass int `json:"pass"` Fail int `json:"fail"` Info int `json:"info"` Results []CISBenchmarkResult `json:"results"` }
CISBenchmarkSectionResult describes the result of running the CIS benchmark on a single component.
func (*CISBenchmarkSectionResult) DeepCopy ¶
func (in *CISBenchmarkSectionResult) DeepCopy() *CISBenchmarkSectionResult
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkSectionResult.
func (*CISBenchmarkSectionResult) DeepCopyInto ¶
func (in *CISBenchmarkSectionResult) DeepCopyInto(out *CISBenchmarkSectionResult)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkSelection ¶
type CISBenchmarkSelection struct { // KubernetesVersion is used select nodes that are running a specific version of kubelet. The full version need not // be fully specified down to the patch level, in which case the significant parts of the version are matched. // e.g. "1.0" will match versions "1.0.1" and "1.0.2" // If not specified, matches all versions. KubernetesVersion string `json:"kubernetesVersion,omitempty"` }
CISBenchmarkSelection selects a particular set of benchmarks.
func (*CISBenchmarkSelection) DeepCopy ¶
func (in *CISBenchmarkSelection) DeepCopy() *CISBenchmarkSelection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkSelection.
func (*CISBenchmarkSelection) DeepCopyInto ¶
func (in *CISBenchmarkSelection) DeepCopyInto(out *CISBenchmarkSelection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CISBenchmarkSummary ¶
type CISBenchmarkSummary struct { Type string `json:"type"` HighCount int `json:"highCount"` MedCount int `json:"medCount"` LowCount int `json:"lowCount"` }
CISBenchmarkSummary describes a CIS benchmarking result across an entire cluster.
func (*CISBenchmarkSummary) DeepCopy ¶
func (in *CISBenchmarkSummary) DeepCopy() *CISBenchmarkSummary
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CISBenchmarkSummary.
func (*CISBenchmarkSummary) DeepCopyInto ¶
func (in *CISBenchmarkSummary) DeepCopyInto(out *CISBenchmarkSummary)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeAgentStatus ¶
type CalicoNodeAgentStatus struct { // BIRDV4 represents the latest observed status of bird4. BIRDV4 BGPDaemonStatus `json:"birdV4,omitempty"` // BIRDV6 represents the latest observed status of bird6. BIRDV6 BGPDaemonStatus `json:"birdV6,omitempty"` }
CalicoNodeAgentStatus defines the observed state of agent status on the node.
func (*CalicoNodeAgentStatus) DeepCopy ¶
func (in *CalicoNodeAgentStatus) DeepCopy() *CalicoNodeAgentStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeAgentStatus.
func (*CalicoNodeAgentStatus) DeepCopyInto ¶
func (in *CalicoNodeAgentStatus) DeepCopyInto(out *CalicoNodeAgentStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeBGPRouteStatus ¶
type CalicoNodeBGPRouteStatus struct { // RoutesV4 represents IPv4 routes on the node. RoutesV4 []CalicoNodeRoute `json:"routesV4,omitempty"` // RoutesV6 represents IPv6 routes on the node. RoutesV6 []CalicoNodeRoute `json:"routesV6,omitempty"` }
CalicoNodeBGPRouteStatus defines the observed state of routes status on the node.
func (*CalicoNodeBGPRouteStatus) DeepCopy ¶
func (in *CalicoNodeBGPRouteStatus) DeepCopy() *CalicoNodeBGPRouteStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeBGPRouteStatus.
func (*CalicoNodeBGPRouteStatus) DeepCopyInto ¶
func (in *CalicoNodeBGPRouteStatus) DeepCopyInto(out *CalicoNodeBGPRouteStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeBGPStatus ¶
type CalicoNodeBGPStatus struct { // The total number of IPv4 established bgp sessions. NumberEstablishedV4 int `json:"numberEstablishedV4"` // The total number of IPv4 non-established bgp sessions. NumberNotEstablishedV4 int `json:"numberNotEstablishedV4"` // The total number of IPv6 established bgp sessions. NumberEstablishedV6 int `json:"numberEstablishedV6"` // The total number of IPv6 non-established bgp sessions. NumberNotEstablishedV6 int `json:"numberNotEstablishedV6"` // PeersV4 represents IPv4 BGP peers status on the node. PeersV4 []CalicoNodePeer `json:"peersV4,omitempty"` // PeersV6 represents IPv6 BGP peers status on the node. PeersV6 []CalicoNodePeer `json:"peersV6,omitempty"` }
CalicoNodeBGPStatus defines the observed state of BGP status on the node.
func (*CalicoNodeBGPStatus) DeepCopy ¶
func (in *CalicoNodeBGPStatus) DeepCopy() *CalicoNodeBGPStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeBGPStatus.
func (*CalicoNodeBGPStatus) DeepCopyInto ¶
func (in *CalicoNodeBGPStatus) DeepCopyInto(out *CalicoNodeBGPStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodePeer ¶
type CalicoNodePeer struct { // IP address of the peer whose condition we are reporting. PeerIP string `json:"peerIP,omitempty" validate:"omitempty,ip"` // Type indicates whether this peer is configured via the node-to-node mesh, // or via en explicit global or per-node BGPPeer object. Type BGPPeerType `json:"type,omitempty"` // State is the BGP session state. State BGPSessionState `json:"state,omitempty"` // Since the state or reason last changed. Since string `json:"since,omitempty"` }
CalicoNodePeer contains the status of BGP peers on the node.
func (*CalicoNodePeer) DeepCopy ¶
func (in *CalicoNodePeer) DeepCopy() *CalicoNodePeer
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodePeer.
func (*CalicoNodePeer) DeepCopyInto ¶
func (in *CalicoNodePeer) DeepCopyInto(out *CalicoNodePeer)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeRoute ¶
type CalicoNodeRoute struct { // Type indicates if the route is being used for forwarding or not. Type CalicoNodeRouteType `json:"type,omitempty"` // Destination of the route. Destination string `json:"destination,omitempty"` // Gateway for the destination. Gateway string `json:"gateway,omitempty"` // Interface for the destination Interface string `json:"interface,omitempty"` // LearnedFrom contains information regarding where this route originated. LearnedFrom CalicoNodeRouteLearnedFrom `json:"learnedFrom,omitempty"` }
CalicoNodeRoute contains the status of BGP routes on the node.
func (*CalicoNodeRoute) DeepCopy ¶
func (in *CalicoNodeRoute) DeepCopy() *CalicoNodeRoute
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeRoute.
func (*CalicoNodeRoute) DeepCopyInto ¶
func (in *CalicoNodeRoute) DeepCopyInto(out *CalicoNodeRoute)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeRouteLearnedFrom ¶
type CalicoNodeRouteLearnedFrom struct { // Type of the source where a route is learned from. SourceType CalicoNodeRouteSourceType `json:"sourceType,omitempty"` // If sourceType is NodeMesh or BGPPeer, IP address of the router that sent us this route. PeerIP string `json:"peerIP,omitempty" validate:"omitempty,ip"` }
CalicoNodeRouteLearnedFrom contains the information of the source from which a routes has been learned.
func (*CalicoNodeRouteLearnedFrom) DeepCopy ¶
func (in *CalicoNodeRouteLearnedFrom) DeepCopy() *CalicoNodeRouteLearnedFrom
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeRouteLearnedFrom.
func (*CalicoNodeRouteLearnedFrom) DeepCopyInto ¶
func (in *CalicoNodeRouteLearnedFrom) DeepCopyInto(out *CalicoNodeRouteLearnedFrom)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeRouteSourceType ¶
type CalicoNodeRouteSourceType string
const ( RouteSourceTypeKernel CalicoNodeRouteSourceType = "Kernel" RouteSourceTypeStatic CalicoNodeRouteSourceType = "Static" RouteSourceTypeDirect CalicoNodeRouteSourceType = "Direct" RouteSourceTypeNodeMesh CalicoNodeRouteSourceType = "NodeMesh" RouteSourceTypeBGPPeer CalicoNodeRouteSourceType = "BGPPeer" )
type CalicoNodeRouteType ¶
type CalicoNodeRouteType string
const ( RouteTypeFIB CalicoNodeRouteType = "FIB" RouteTypeRIB CalicoNodeRouteType = "RIB" )
type CalicoNodeStatus ¶
type CalicoNodeStatus struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec CalicoNodeStatusSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` Status CalicoNodeStatusStatus `json:"status,omitempty" protobuf:"bytes,2,opt,name=status"` }
func NewCalicoNodeStatus ¶
func NewCalicoNodeStatus() *CalicoNodeStatus
NewCalicoNodeStatus creates a new (zeroed) CalicoNodeStatus struct with the TypeMetadata initialised to the current version.
func (*CalicoNodeStatus) DeepCopy ¶
func (in *CalicoNodeStatus) DeepCopy() *CalicoNodeStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeStatus.
func (*CalicoNodeStatus) DeepCopyInto ¶
func (in *CalicoNodeStatus) DeepCopyInto(out *CalicoNodeStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*CalicoNodeStatus) DeepCopyObject ¶
func (in *CalicoNodeStatus) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type CalicoNodeStatusList ¶
type CalicoNodeStatusList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []CalicoNodeStatus `json:"items" protobuf:"bytes,2,rep,name=items"` }
CalicoNodeStatusList is a list of CalicoNodeStatus resources.
func (*CalicoNodeStatusList) DeepCopy ¶
func (in *CalicoNodeStatusList) DeepCopy() *CalicoNodeStatusList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeStatusList.
func (*CalicoNodeStatusList) DeepCopyInto ¶
func (in *CalicoNodeStatusList) DeepCopyInto(out *CalicoNodeStatusList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*CalicoNodeStatusList) DeepCopyObject ¶
func (in *CalicoNodeStatusList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type CalicoNodeStatusSpec ¶
type CalicoNodeStatusSpec struct { // The node name identifies the Calico node instance for node status. Node string `json:"node,omitempty" validate:"required,name"` // Classes declares the types of information to monitor for this calico/node, // and allows for selective status reporting about certain subsets of information. Classes []NodeStatusClassType `json:"classes,omitempty" validate:"required,unique"` // UpdatePeriodSeconds is the period at which CalicoNodeStatus should be updated. // Set to 0 to disable CalicoNodeStatus refresh. Maximum update period is one day. UpdatePeriodSeconds *uint32 `json:"updatePeriodSeconds,omitempty" validate:"required,gte=0,lte=86400"` }
CalicoNodeStatusSpec contains the specification for a CalicoNodeStatus resource.
func (*CalicoNodeStatusSpec) DeepCopy ¶
func (in *CalicoNodeStatusSpec) DeepCopy() *CalicoNodeStatusSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeStatusSpec.
func (*CalicoNodeStatusSpec) DeepCopyInto ¶
func (in *CalicoNodeStatusSpec) DeepCopyInto(out *CalicoNodeStatusSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CalicoNodeStatusStatus ¶
type CalicoNodeStatusStatus struct { // LastUpdated is a timestamp representing the server time when CalicoNodeStatus object // last updated. It is represented in RFC3339 form and is in UTC. // +nullable LastUpdated metav1.Time `json:"lastUpdated,omitempty"` // Agent holds agent status on the node. Agent CalicoNodeAgentStatus `json:"agent,omitempty"` // BGP holds node BGP status. BGP CalicoNodeBGPStatus `json:"bgp,omitempty"` // Routes reports routes known to the Calico BGP daemon on the node. Routes CalicoNodeBGPRouteStatus `json:"routes,omitempty"` }
CalicoNodeStatusStatus defines the observed state of CalicoNodeStatus. No validation needed for status since it is updated by Calico.
func (*CalicoNodeStatusStatus) DeepCopy ¶
func (in *CalicoNodeStatusStatus) DeepCopy() *CalicoNodeStatusStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CalicoNodeStatusStatus.
func (*CalicoNodeStatusStatus) DeepCopyInto ¶
func (in *CalicoNodeStatusStatus) DeepCopyInto(out *CalicoNodeStatusStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ClusterInformation ¶
type ClusterInformation struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec ClusterInformationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewClusterInformation ¶
func NewClusterInformation() *ClusterInformation
New ClusterInformation creates a new (zeroed) ClusterInformation struct with the TypeMetadata initialized to the current version.
func (*ClusterInformation) DeepCopy ¶
func (in *ClusterInformation) DeepCopy() *ClusterInformation
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterInformation.
func (*ClusterInformation) DeepCopyInto ¶
func (in *ClusterInformation) DeepCopyInto(out *ClusterInformation)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ClusterInformation) DeepCopyObject ¶
func (in *ClusterInformation) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ClusterInformationList ¶
type ClusterInformationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []ClusterInformation `json:"items" protobuf:"bytes,2,rep,name=items"` }
ClusterInformationList is a list of ClusterInformation objects.
func (*ClusterInformationList) DeepCopy ¶
func (in *ClusterInformationList) DeepCopy() *ClusterInformationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterInformationList.
func (*ClusterInformationList) DeepCopyInto ¶
func (in *ClusterInformationList) DeepCopyInto(out *ClusterInformationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ClusterInformationList) DeepCopyObject ¶
func (in *ClusterInformationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ClusterInformationSpec ¶
type ClusterInformationSpec struct { // ClusterGUID is the GUID of the cluster ClusterGUID string `json:"clusterGUID,omitempty" validate:"omitempty"` // ClusterType describes the type of the cluster ClusterType string `json:"clusterType,omitempty" validate:"omitempty"` // CalicoVersion is the version of Calico that the cluster is running CalicoVersion string `json:"calicoVersion,omitempty" validate:"omitempty"` // CNXVersion is the version of CNX that the cluster is running CNXVersion string `json:"cnxVersion,omitempty" validate:"omitempty"` // DatastoreReady is used during significant datastore migrations to signal to components // such as Felix that it should wait before accessing the datastore. DatastoreReady *bool `json:"datastoreReady,omitempty"` // Variant declares which variant of Calico should be active. Variant string `json:"variant,omitempty"` }
ClusterInformationSpec contains the values of describing the cluster.
func (*ClusterInformationSpec) DeepCopy ¶
func (in *ClusterInformationSpec) DeepCopy() *ClusterInformationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterInformationSpec.
func (*ClusterInformationSpec) DeepCopyInto ¶
func (in *ClusterInformationSpec) DeepCopyInto(out *ClusterInformationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Community ¶
type Community struct { // Name given to community value. Name string `json:"name,omitempty" validate:"required,name"` // Value must be of format `aa:nn` or `aa:nn:mm`. // For standard community use `aa:nn` format, where `aa` and `nn` are 16 bit number. // For large community use `aa:nn:mm` format, where `aa`, `nn` and `mm` are 32 bit number. // Where, `aa` is an AS Number, `nn` and `mm` are per-AS identifier. // +kubebuilder:validation:Pattern=`^(\d+):(\d+)$|^(\d+):(\d+):(\d+)$` Value string `json:"value,omitempty" validate:"required"` }
Community contains standard or large community value and its name.
func (*Community) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Community.
func (*Community) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type CompletedReportJob ¶
type CompletedReportJob struct { ReportJob `json:",inline"` // The time the report job completed. JobCompletionTime *metav1.Time `json:"jobCompletionTime,omitempty"` }
CompletedReportJob augments the ReportJob with completion details.
func (*CompletedReportJob) DeepCopy ¶
func (in *CompletedReportJob) DeepCopy() *CompletedReportJob
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CompletedReportJob.
func (*CompletedReportJob) DeepCopyInto ¶
func (in *CompletedReportJob) DeepCopyInto(out *CompletedReportJob)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ControllersConfig ¶
type ControllersConfig struct { // Node enables and configures the node controller. Enabled by default, set to nil to disable. Node *NodeControllerConfig `json:"node,omitempty"` // Policy enables and configures the policy controller. Enabled by default, set to nil to disable. Policy *PolicyControllerConfig `json:"policy,omitempty"` // WorkloadEndpoint enables and configures the workload endpoint controller. Enabled by default, set to nil to disable. WorkloadEndpoint *WorkloadEndpointControllerConfig `json:"workloadEndpoint,omitempty"` // ServiceAccount enables and configures the service account controller. Enabled by default, set to nil to disable. ServiceAccount *ServiceAccountControllerConfig `json:"serviceAccount,omitempty"` // Namespace enables and configures the namespace controller. Enabled by default, set to nil to disable. Namespace *NamespaceControllerConfig `json:"namespace,omitempty"` // FederatedServices enables and configures the federatedservices controller. Disabled by default. FederatedServices *FederatedServicesControllerConfig `json:"federatedServices,omitempty"` }
ControllersConfig enables and configures individual Kubernetes controllers
func (*ControllersConfig) DeepCopy ¶
func (in *ControllersConfig) DeepCopy() *ControllersConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllersConfig.
func (*ControllersConfig) DeepCopyInto ¶
func (in *ControllersConfig) DeepCopyInto(out *ControllersConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DNSPolicyMode ¶
type DNSPolicyMode string
+kubebuilder:validation:Enum=NoDelay;DelayDeniedPacket;DelayDNSResponse
const ( DNSPolicyModeNoDelay DNSPolicyMode = "NoDelay" DNSPolicyModeDelayDeniedPacket DNSPolicyMode = "DelayDeniedPacket" DNSPolicyModeDelayDNSResponse DNSPolicyMode = "DelayDNSResponse" )
type DPIActive ¶
type DPIActive struct { // Success indicates if deep packet inspection is running on all workloads matching the selector. Success bool `json:"success,omitempty"` // Timestamp of when the active status was last updated. LastUpdated *metav1.Time `json:"lastUpdated,omitempty"` }
func (*DPIActive) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DPIActive.
func (*DPIActive) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DPIErrorCondition ¶
type DPIErrorCondition struct { // Message from deep packet inspection error. Message string `json:"message,omitempty"` // Timestamp of when this error message was added. LastUpdated *metav1.Time `json:"lastUpdated,omitempty"` }
func (*DPIErrorCondition) DeepCopy ¶
func (in *DPIErrorCondition) DeepCopy() *DPIErrorCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DPIErrorCondition.
func (*DPIErrorCondition) DeepCopyInto ¶
func (in *DPIErrorCondition) DeepCopyInto(out *DPIErrorCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DPINode ¶
type DPINode struct { // Node identifies with a physical node from the cluster via its hostname. Node string `json:"node,omitempty"` Active DPIActive `json:"active,omitempty"` // +kubebuilder:validation:MaxItems:=10 ErrorConditions []DPIErrorCondition `json:"errorConditions,omitempty"` }
func (*DPINode) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DPINode.
func (*DPINode) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DashboardData ¶
type DashboardData struct { // Namespace user selected for the dashboard SelectedNamespace string `json:"selectedNamespace,omitempty" validate:"omitempty"` // Type of the dashboard Type string `json:"type,omitempty" validate:"omitempty"` // Layout information of the dashboard card Layout DashboardLayout `json:"layout,omitempty" validate:"omitempty"` }
func (*DashboardData) DeepCopy ¶
func (in *DashboardData) DeepCopy() *DashboardData
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DashboardData.
func (*DashboardData) DeepCopyInto ¶
func (in *DashboardData) DeepCopyInto(out *DashboardData)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DashboardLayout ¶
type DashboardLayout struct { // Index of the dashboard Index *string `json:"index,omitempty" validate:"omitempty"` // X coordinate of the top-left corner of the dashboard card XPos uint32 `json:"xPos"` // Y coordinate of the top-left corner of the dashboard card YPos uint32 `json:"yPos"` // Width of the dashboard card Width uint32 `json:"width" validate:"gt=0"` // Height of the dashboard card Height uint32 `json:"height" validate:"gt=0"` // Minimum limit set for the size of the dashboard card width MinWidth *uint32 `json:"minWidth,omitempty" validate:"omitempty,gt=0"` // Maximum limit set for the size of the dashboard card width MaxWidth *uint32 `json:"maxWidth,omitempty" validate:"omitempty,gt=0"` // Minimum limit set for the size of the dashboard card height MinHeight *uint32 `json:"minHeight,omitempty" validate:"omitempty,gt=0"` // Maximum limit set for the size of the dashboard card height MaxHeight *uint32 `json:"maxHeight,omitempty" validate:"omitempty,gt=0"` // Whether this dashboard card should be re-sizeable or not IsResizable *bool `json:"isResizable,omitempty" validate:"omitempty"` // Whether this dashboard card should be visible or not IsVisible *bool `json:"isVisible,omitempty" validate:"omitempty"` // Whether this dashboard is in namespace view or not IsInNamespaceView *bool `json:"isInNamespaceView,omitempty" validate:"omitempty"` }
func (*DashboardLayout) DeepCopy ¶
func (in *DashboardLayout) DeepCopy() *DashboardLayout
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DashboardLayout.
func (*DashboardLayout) DeepCopyInto ¶
func (in *DashboardLayout) DeepCopyInto(out *DashboardLayout)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DeepPacketInspection ¶
type DeepPacketInspection struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the DeepPacketInspection. Spec DeepPacketInspectionSpec `json:"spec,omitempty"` // Status of the DeepPacketInspection. Status DeepPacketInspectionStatus `json:"status,omitempty"` }
func NewDeepPacketInspection ¶
func NewDeepPacketInspection() *DeepPacketInspection
NewDeepPacketInspection creates a new (zeroed) DeepPacketInspection struct with the TypeMetadata initialized to the current version.
func (*DeepPacketInspection) DeepCopy ¶
func (in *DeepPacketInspection) DeepCopy() *DeepPacketInspection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeepPacketInspection.
func (*DeepPacketInspection) DeepCopyInto ¶
func (in *DeepPacketInspection) DeepCopyInto(out *DeepPacketInspection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*DeepPacketInspection) DeepCopyObject ¶
func (in *DeepPacketInspection) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type DeepPacketInspectionList ¶
type DeepPacketInspectionList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []DeepPacketInspection `json:"items"` }
DeepPacketInspectionList contains list of DeepPacketInspection resource.
func NewDeepPacketInspectionList ¶
func NewDeepPacketInspectionList() *DeepPacketInspectionList
NewDeepPacketInspectionList creates a new zeroed) DeepPacketInspectionList struct with the TypeMetadata initialized to the current version.
func (*DeepPacketInspectionList) DeepCopy ¶
func (in *DeepPacketInspectionList) DeepCopy() *DeepPacketInspectionList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeepPacketInspectionList.
func (*DeepPacketInspectionList) DeepCopyInto ¶
func (in *DeepPacketInspectionList) DeepCopyInto(out *DeepPacketInspectionList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*DeepPacketInspectionList) DeepCopyObject ¶
func (in *DeepPacketInspectionList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type DeepPacketInspectionSpec ¶
type DeepPacketInspectionSpec struct { // The selector is an expression used to pick out the endpoints for which deep packet inspection should // be performed on. The selector will only match endpoints in the same namespace as the // DeepPacketInspection resource. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() or the empty selector -> matches all endpoints. // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) Selector string `json:"selector,omitempty" validate:"selector"` }
DeepPacketInspectionSpec contains the values of the deep packet inspection.
func (*DeepPacketInspectionSpec) DeepCopy ¶
func (in *DeepPacketInspectionSpec) DeepCopy() *DeepPacketInspectionSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeepPacketInspectionSpec.
func (*DeepPacketInspectionSpec) DeepCopyInto ¶
func (in *DeepPacketInspectionSpec) DeepCopyInto(out *DeepPacketInspectionSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DeepPacketInspectionStatus ¶
type DeepPacketInspectionStatus struct {
Nodes []DPINode `json:"nodes,omitempty"`
}
DeepPacketInspectionStatus contains status of deep packet inspection in each node.
func (*DeepPacketInspectionStatus) DeepCopy ¶
func (in *DeepPacketInspectionStatus) DeepCopy() *DeepPacketInspectionStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DeepPacketInspectionStatus.
func (*DeepPacketInspectionStatus) DeepCopyInto ¶
func (in *DeepPacketInspectionStatus) DeepCopyInto(out *DeepPacketInspectionStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type DetectorParams ¶
type DetectorParams struct { // Name specifies the AnomalyDetection Detector to run. Name string `json:"name"` }
func (*DetectorParams) DeepCopy ¶
func (in *DetectorParams) DeepCopy() *DetectorParams
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DetectorParams.
func (*DetectorParams) DeepCopyInto ¶
func (in *DetectorParams) DeepCopyInto(out *DetectorParams)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressGatewayPolicy ¶
type EgressGatewayPolicy struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec EgressGatewayPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewEgressGatewayPolicy ¶
func NewEgressGatewayPolicy() *EgressGatewayPolicy
New EgressGatewayPolicy creates a new (zeroed) EgressGatewayPolicy struct with the TypeMetadata initialized to the current version.
func (*EgressGatewayPolicy) DeepCopy ¶
func (in *EgressGatewayPolicy) DeepCopy() *EgressGatewayPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayPolicy.
func (*EgressGatewayPolicy) DeepCopyInto ¶
func (in *EgressGatewayPolicy) DeepCopyInto(out *EgressGatewayPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*EgressGatewayPolicy) DeepCopyObject ¶
func (in *EgressGatewayPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type EgressGatewayPolicyDestinationSpec ¶
type EgressGatewayPolicyDestinationSpec struct { // The destination network CIDR. CIDR string `json:"cidr,omitempty" validate:"omitempty,net"` }
DestinationSpec define a destination network that can be reached via an egress gateway
func (*EgressGatewayPolicyDestinationSpec) DeepCopy ¶
func (in *EgressGatewayPolicyDestinationSpec) DeepCopy() *EgressGatewayPolicyDestinationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayPolicyDestinationSpec.
func (*EgressGatewayPolicyDestinationSpec) DeepCopyInto ¶
func (in *EgressGatewayPolicyDestinationSpec) DeepCopyInto(out *EgressGatewayPolicyDestinationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressGatewayPolicyList ¶
type EgressGatewayPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []EgressGatewayPolicy `json:"items" protobuf:"bytes,2,rep,name=items"` }
EgressGatewayPolicyList is a list of EgressGatewayPolicy resources.
func (*EgressGatewayPolicyList) DeepCopy ¶
func (in *EgressGatewayPolicyList) DeepCopy() *EgressGatewayPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayPolicyList.
func (*EgressGatewayPolicyList) DeepCopyInto ¶
func (in *EgressGatewayPolicyList) DeepCopyInto(out *EgressGatewayPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*EgressGatewayPolicyList) DeepCopyObject ¶
func (in *EgressGatewayPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type EgressGatewayPolicySpec ¶
type EgressGatewayPolicySpec struct { // The ordered set of Egress Gateway Policies to define how traffic exit a cluster Rules []EgressGatewayRule `json:"rules,omitempty" validate:"required"` }
EgressGatewayPolicySpec contains the egress policy rules for each destination network
func (*EgressGatewayPolicySpec) DeepCopy ¶
func (in *EgressGatewayPolicySpec) DeepCopy() *EgressGatewayPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayPolicySpec.
func (*EgressGatewayPolicySpec) DeepCopyInto ¶
func (in *EgressGatewayPolicySpec) DeepCopyInto(out *EgressGatewayPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressGatewayRule ¶
type EgressGatewayRule struct { // The destination network that can be reached via egress gateway. // If no destination is set, the default route, 0.0.0.0/0, is used instead. // +optional Destination *EgressGatewayPolicyDestinationSpec `json:"destination,omitempty" validate:"omitempty"` // The description of the EgressGatewayPolicy rule. // +optional Description string `json:"description,omitempty" validate:"omitempty,uiDescription"` // Gateway specifies the egress gateway that should be used for the specified destination. // If no gateway is set then the destination is routed normally rather than via an egress gateway. // +optional Gateway *EgressSpec `json:"gateway,omitempty" validate:"omitempty"` // GatewayPreference specifies which egress gateways to use. If set to PreferNodeLocal, egress gateways in the same node as // the client will be used if available. Otherwise all the active egress gateways will be used. // +kubebuilder:default=None // +optional GatewayPreference *GatewayPreferenceType `json:"gatewayPreference,omitempty" validate:"omitempty,oneof=None,PreferNodeLocal"` }
EgressGatewayRule defines an Egress Gateway to reach a destination network
func (*EgressGatewayRule) DeepCopy ¶
func (in *EgressGatewayRule) DeepCopy() *EgressGatewayRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewayRule.
func (*EgressGatewayRule) DeepCopyInto ¶
func (in *EgressGatewayRule) DeepCopyInto(out *EgressGatewayRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressGatewaySpec ¶
type EgressGatewaySpec struct { // Only one of these may be set. // Reference to an EgressGatewayPolicy to use. Policy string `json:"policy,omitempty" validate:"omitempty"` // Reference to a specific EgressGateway to use. Gateway *EgressSpec `json:"gateway,omitempty" validate:"omitempty"` }
EgressGatewaySpec allows to define an egress gateway directly, or to refer to an egress gateway policy resource.
func (*EgressGatewaySpec) DeepCopy ¶
func (in *EgressGatewaySpec) DeepCopy() *EgressGatewaySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressGatewaySpec.
func (*EgressGatewaySpec) DeepCopyInto ¶
func (in *EgressGatewaySpec) DeepCopyInto(out *EgressGatewaySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EgressSpec ¶
type EgressSpec struct { // NamespaceSelector selects one or more namespaces containing an egress gateway deployment. NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"omitempty,selector"` // Selector is an expression used to pick out the egress gateway that the destination can // be reached via. Selector string `json:"selector,omitempty" validate:"omitempty,selector"` // MaxNextHops specifies the maximum number of egress gateway replicas from the selected // deployment that a pod should depend on. MaxNextHops int `json:"maxNextHops,omitempty" validate:"omitempty,gte=0"` }
EgressSpec defines which egress gateway should be used.
func (*EgressSpec) DeepCopy ¶
func (in *EgressSpec) DeepCopy() *EgressSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EgressSpec.
func (*EgressSpec) DeepCopyInto ¶
func (in *EgressSpec) DeepCopyInto(out *EgressSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EncapMode ¶
type EncapMode string
The following definitions are only used for APIv1 backwards compatibility. They are for internal use only.
type EndpointPort ¶
type EndpointPort struct { Name string `json:"name" validate:"portName"` Protocol numorstring.Protocol `json:"protocol"` Port uint16 `json:"port" validate:"gt=0"` }
func (*EndpointPort) DeepCopy ¶
func (in *EndpointPort) DeepCopy() *EndpointPort
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointPort.
func (*EndpointPort) DeepCopyInto ¶
func (in *EndpointPort) DeepCopyInto(out *EndpointPort)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsReportEndpoint ¶
type EndpointsReportEndpoint struct { Endpoint ResourceID `json:"endpoint,omitempty"` // Whether ingress traffic to this endpoint was always protected during the reporting interval. // // Ingress protection is defined as denying ingress traffic unless explicitly whitelisted. This is translated as // the endpoint having some explicit ingress policy applied to it. // // Source: Calculated from the set of ingress policies that apply to each endpoint. // // Set to: // - false if there are no ingress policies applied to the endpoint at any point during the reporting interval. // - true otherwise. // // Note: Policy is not inspected for protection bypass: for example match-all-and-allow rules which would effectively // short-circuit the default tier-drop behavior, in this case the match-all-and-allow would be considered to be // an explicit whitelist of all traffic. We could include simplistic all-match rules and check that they // don't result in an allow. To check for more circuitous match-all allows is much trickier (e.g. you have one // rule that allows for src!=1.2.3.0/24 and another rule that allows for src==1.2.3.0/24, which combined // is essentially an allow-all). IngressProtected bool `json:"ingressProtected,omitempty"` // Whether egress traffic to this endpoint was always protected during the reporting interval. // // Egress protection is defined as denying egress traffic unless explicitly whitelisted. This is translated as // the endpoint having some explicit egress policy applied to it. // // Source: Calculated from the set of egress policies that apply to each endpoint. // // Set to: // - false if there are no egress policies applied to the endpoint at any point during the reporting interval. // - true otherwise. // // Note: Policy is not inspected for protection bypass: for example match-all-and-allow rules which would effectively // short-circuit the default tier-drop behavior, in this case the match-all-and-allow would be considered to be // an explicit whitelist of all traffic. We could include simplistic all-match rules and check that they // don't result in an allow. To check for more circuitous match-all allows is much trickier (e.g. you have one // rule that allows for src!=1.2.3.0/24 and another rule that allows for src==1.2.3.0/24, which combined // is essentially an allow-all). Similarly, policy that only contains pass rules would still count as being // protected. EgressProtected bool `json:"egressProtected,omitempty"` // Whether the matching policy has any ingress allow rules from a public IP address (as defined by the complement of // the private addresses; private addresses default to those defined in RFC 1918, but may also be configured separately). // // Source: Calculated from the policies applied to the endpoint. The ingress allow rules in each policy are checked // to determine if any CIDR specified in the rule, either directly or through a matching network set, is an // internet address. Endpoint addresses are not included - therefore ingress from a pod that has a public // IP address will not be considered as “from internet”. // // Note: This is a simplification since it does not examine the policies to determine if it's actually possible to // hit one of these allow rules (e.g. a previous rule may be a match-all-deny). IngressFromInternet bool `json:"ingressFromInternet,omitempty"` // Whether the matching policy has any egress allow rules to a public IP address (as defined by the complement of // the private addresses; private addresses default to those defined in RFC 1918, but may also be configured separately). // // Source: Calculated from the policies applied to the endpoint. The egress allow rules in each policy are checked // to determine if any CIDR specified in the rule, either directly or through a matching network set, is an // internet address. Endpoint addresses are not included - therefore egress to a pod that has a public // IP address will not be considered as “to internet”. // // Note 1: This is a simplification since it does not examine the policies to determine if it's actually possible to // hit one of these allow rules (e.g. a previous rule may be a match-all-deny). EgressToInternet bool `json:"egressToInternet,omitempty"` // Whether the matching policy has any ingress allow rules from another namespace. // // Source: Calculated from the policies applied to the endpoint. // // Set to true if: // - this is a pod (i.e. namespaced) with an applied GlobalNetworkPolicy with an ingress allow rule with no CIDR match. // - this is a pod with an applied NetworkPolicy with an ingress allow rule with a non-empty NamespaceSelector. // // Note: This is a simplification since it does not examine the policies to determine if it's actually possible to // hit one of these allow rules (e.g. a previous rule may be a match-all-deny, or endpoint selector may not // match any endpoints within the namespace). IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"` // Whether the matching policy has any egress allow rules to another namespace. // // Source: Calculated from the policies applied to the endpoint. // // Set to true if: // - this is a pod endpoint (i.e. namespaced) matches a GlobalNetworkPolicy with an egress allow rule with no CIDR match. // - this is a pod endpoint which matches a NetworkPolicy with an egress allow rule with a non-empty NamespaceSelector. // // Note: This is a simplification since it does not examine the policies to determine if it's actually possible to // hit one of these allow rules (e.g. a previous rule may be a match-all-deny, or endpoint selector may not // match any endpoints within the namespace). EgressToOtherNamespace bool `json:"egressToOtherNamespace,omitempty"` // Whether this pod is envoy-enabled. This is simply an indicator of whether an Envoy container is running within the pod. // Provided Istio is configured appropriately, this can provide a simplistic determination of whether the pod is mTLS // enabled. // // Source: Pod spec. // // Set to: // - true if envoy is running within the pod // - false if envoy is not running within the pod EnvoyEnabled bool `json:"envoyEnabled,omitempty"` // The set of policies that apply to an endpoint may change within the reporting interval, this is the superset of all // policies that applied to the endpoint during that interval. AppliedPolicies []ResourceID `json:"appliedPolicies,omitempty"` // The list of services that exposed this endpoint at any moment during the reporting interval. // // Source: Determined from the Kubernetes endpoints resource associated with the service. Services []ResourceID `json:"services,omitempty"` // The ServiceAccount configured on this endpoint. ServiceAccount string `json:"serviceAccount,omitempty"` // The flow log aggregation name. This is used to locate flow logs associated with this endpoint when flow log // aggregation is turned on. FlowLogAggregationName string `json:"flowLogAggregationName,omitempty"` }
func (*EndpointsReportEndpoint) DeepCopy ¶
func (in *EndpointsReportEndpoint) DeepCopy() *EndpointsReportEndpoint
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsReportEndpoint.
func (*EndpointsReportEndpoint) DeepCopyInto ¶
func (in *EndpointsReportEndpoint) DeepCopyInto(out *EndpointsReportEndpoint)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsReportFlow ¶
type EndpointsReportFlow struct { // The source of the flow log. Source FlowEndpoint `json:"source"` // The destination of the flow log. Destination FlowEndpoint `json:"destination"` }
func (*EndpointsReportFlow) DeepCopy ¶
func (in *EndpointsReportFlow) DeepCopy() *EndpointsReportFlow
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsReportFlow.
func (*EndpointsReportFlow) DeepCopyInto ¶
func (in *EndpointsReportFlow) DeepCopyInto(out *EndpointsReportFlow)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsReportNamespace ¶
type EndpointsReportNamespace struct { Namespace ResourceID `json:"namespace,omitempty"` // Whether ingress traffic was protected for all endpoints within this namespace within the reporting interval. // This is a summary of information contained in the endpoints data. IngressProtected bool `json:"ingressProtected,omitempty"` // Whether egress traffic was protected for all endpoints within this namespace within the reporting interval. // This is a summary of information contained in the endpoints data. EgressProtected bool `json:"egressProtected,omitempty"` // Whether ingress traffic was allowed from the internet for any endpoint within this namespace within the reporting // interval. IngressFromInternet bool `json:"ingressFromInternet,omitempty"` // Whether ingress traffic was allowed from the internet for any endpoint within this namespace within the reporting // interval. EgressToInternet bool `json:"egressToInternet,omitempty"` // Whether ingress traffic was allowed from another namespace for any endpoint within this namespace within the // reporting interval. IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"` // Whether ingress traffic was allowed from another namespace for any endpoint within this namespace within the // reporting interval. EgressToOtherNamespace bool `json:"egressToOtherNamespace,omitempty"` // Whether envoy was enabled for all endpoints within this namespace within the reporting interval. // This is a summary of information contained in the endpoints data. EnvoyEnabled bool `json:"envoyEnabled,omitempty"` }
func (*EndpointsReportNamespace) DeepCopy ¶
func (in *EndpointsReportNamespace) DeepCopy() *EndpointsReportNamespace
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsReportNamespace.
func (*EndpointsReportNamespace) DeepCopyInto ¶
func (in *EndpointsReportNamespace) DeepCopyInto(out *EndpointsReportNamespace)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsReportService ¶
type EndpointsReportService struct { Service ResourceID `json:"service,omitempty"` // Whether ingress traffic was protected for all endpoints within this namespace within the reporting interval. // This is a summary of information contained in the endpoints data. IngressProtected bool `json:"ingressProtected,omitempty"` // Whether ingress traffic was allowed from the internet for any endpoint exposed by this service within the reporting // interval. IngressFromInternet bool `json:"ingressFromInternet,omitempty"` // Whether ingress traffic was allowed from another namespace for any endpoint exposed by this service within the // reporting interval. IngressFromOtherNamespace bool `json:"ingressFromOtherNamespace,omitempty"` // Whether envoy was enabled for all endpoints that were exposed by this service within the reporting interval. // This is a summary of information contained in the endpoints data. EnvoyEnabled bool `json:"envoyEnabled,omitempty"` }
func (*EndpointsReportService) DeepCopy ¶
func (in *EndpointsReportService) DeepCopy() *EndpointsReportService
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsReportService.
func (*EndpointsReportService) DeepCopyInto ¶
func (in *EndpointsReportService) DeepCopyInto(out *EndpointsReportService)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsSelection ¶
type EndpointsSelection struct { // Selector, selects endpoints by endpoint labels. If omitted, all endpoints are included in the report // data. Selector string `json:"selector,omitempty" validate:"omitempty,selector"` // Namespace match restricts endpoint selection to those in the selected namespaces. Namespaces *NamesAndLabelsMatch `json:"namespaces,omitempty" validate:"omitempty"` // ServiceAccount match restricts endpoint selection to those in the selected service accounts. ServiceAccounts *NamesAndLabelsMatch `json:"serviceAccounts,omitempty" validate:"omitempty"` }
EndpointsSelection is a set of selectors used to select the endpoints that are considered to be in-scope for the report. An empty selector is equivalent to all(). All three selectors are ANDed together.
func (*EndpointsSelection) DeepCopy ¶
func (in *EndpointsSelection) DeepCopy() *EndpointsSelection
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsSelection.
func (*EndpointsSelection) DeepCopyInto ¶
func (in *EndpointsSelection) DeepCopyInto(out *EndpointsSelection)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EndpointsSummary ¶
type EndpointsSummary struct { // For endpoints: the total number of in-scope endpoints. // Namespaces: the total number of namespaces containing in-scope endpoints. // Services: the total number of services containing in-scope endpoints. // // Source: Calculated from pod/wep, hep, namespace and service account labels. NumTotal int `json:"numTotal,omitempty"` // For endpoints: the total number of service accounts for in-scope endpoints. // Namespaces: n/a. // Services: n/a. NumServiceAccounts int `json:"numServiceAccounts,omitempty"` // For endpoints: the number of in-scope endpoints that were ingress protected during the reporting interval. // Namespaces: the number of namespaces whose in-scope endpoints were ingress protected during // the reporting interval. // Services: the number of services whose in-scope endpoints were ingress protected during the reporting // interval. // // See below for defn of ingress-protected. NumIngressProtected int `json:"numIngressProtected,omitempty"` // For endpoints: the number of in-scope endpoints that were egress protected during the reporting interval. // Namespaces: the number of namespaces whose in-scope endpoints were egress protected during the reporting // interval. // // See below for defn of egress-protected. NumEgressProtected int `json:"numEgressProtected,omitempty"` // For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from the Internet // for *any* period within the reporting interval. // (See below for how this is calculated for an endpoint.) // Namespaces: the number of namespaces that contained in-scope endpoints that would allow ingress traffic // from the Internet for *any* period within the reporting interval. // Services: the number of services that contained in-scope endpoints that would allow ingress traffic // from the Internet for *any* period within the reporting interval. NumIngressFromInternet int `json:"numIngressFromInternet,omitempty"` // For endpoints: the number of in-scope endpoints whose policy would allow egress traffic to the Internet // for *any* period within the reporting interval. // (See below for how this is calculated for an endpoint.) // Namespaces: the number of namespaces that contained in-scope endpoints that would allow egress traffic // to the Internet for *any* period within the reporting interval. NumEgressToInternet int `json:"numEgressToInternet,omitempty"` // For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from a // different namespace for *any* period within the reporting interval. // (See below for how this is calculated for an endpoint.) // Namespaces: the number of namespaces that contained in-scope endpoints that would allow ingress // traffic from another namespace for *any* period within the reporting interval. // Services: the number of services that contained in-scope endpoints that would allow ingress // traffic from another namespace for *any* period within the reporting interval. NumIngressFromOtherNamespace int `json:"numIngressFromOtherNamespace,omitempty"` // For endpoints: the number of in-scope endpoints whose policy would allow ingress traffic from // a different namespace for *any* period within the reporting interval. // (See below for how this is calculated for an endpoint.) // Namespaces: the number of namespaces that contained in-scope endpoints that would allow egress // traffic to another namespace for *any* period within the reporting interval. NumEgressToOtherNamespace int `json:"numEgressToOtherNamespace,omitempty"` // For endpoints: the number of in-scope endpoints that were envoy-enabled within the reporting interval. // Namespaces: the number of namespaces whose in-scope endpoints were always Envoy-enabled // Services: the number of services whose in-scope endpoints were always Envoy-enabled // // See below for defn of envoy-enabled NumEnvoyEnabled int `json:"numEnvoyEnabled,omitempty"` }
This tracks different statistics for Endpoints, Summary and Services.
func (*EndpointsSummary) DeepCopy ¶
func (in *EndpointsSummary) DeepCopy() *EndpointsSummary
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointsSummary.
func (*EndpointsSummary) DeepCopyInto ¶
func (in *EndpointsSummary) DeepCopyInto(out *EndpointsSummary)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EntityRule ¶
type EntityRule struct { // Nets is an optional field that restricts the rule to only apply to traffic that // originates from (or terminates at) IP addresses in any of the given subnets. Nets []string `json:"nets,omitempty" validate:"omitempty,dive,net"` // Selector is an optional field that contains a selector expression (see Policy for // sample syntax). Only traffic that originates from (terminates at) endpoints matching // the selector will be matched. // // Note that: in addition to the negated version of the Selector (see NotSelector below), the // selector expression syntax itself supports negation. The two types of negation are subtly // different. One negates the set of matched endpoints, the other negates the whole match: // // Selector = "!has(my_label)" matches packets that are from other Calico-controlled // endpoints that do not have the label "my_label". // // NotSelector = "has(my_label)" matches packets that are not from Calico-controlled // endpoints that do have the label "my_label". // // The effect is that the latter will accept packets from non-Calico sources whereas the // former is limited to packets from Calico-controlled endpoints. Selector string `json:"selector,omitempty" validate:"omitempty,selector"` // NamespaceSelector is an optional field that contains a selector expression. Only traffic // that originates from (or terminates at) endpoints within the selected namespaces will be // matched. When both NamespaceSelector and another selector are defined on the same rule, then only // workload endpoints that are matched by both selectors will be selected by the rule. // // For NetworkPolicy, an empty NamespaceSelector implies that the Selector is limited to selecting // only workload endpoints in the same namespace as the NetworkPolicy. // // For NetworkPolicy, `global()` NamespaceSelector implies that the Selector is limited to selecting // only GlobalNetworkSet or HostEndpoint. // // For GlobalNetworkPolicy, an empty NamespaceSelector implies the Selector applies to workload // endpoints across all namespaces. NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"omitempty,selector"` // Services is an optional field that contains options for matching Kubernetes Services. // If specified, only traffic that originates from or terminates at endpoints within the selected // service(s) will be matched, and only to/from each endpoint's port. // // Services cannot be specified on the same rule as Selector, NotSelector, NamespaceSelector, Nets, // NotNets or ServiceAccounts. // // Ports and NotPorts can only be specified with Services on ingress rules. Services *ServiceMatch `json:"services,omitempty" validate:"omitempty"` // Ports is an optional field that restricts the rule to only apply to traffic that has a // source (destination) port that matches one of these ranges/values. This value is a // list of integers or strings that represent ranges of ports. // // Since only some protocols have ports, if any ports are specified it requires the // Protocol match in the Rule to be set to "TCP" or "UDP". Ports []numorstring.Port `json:"ports,omitempty" validate:"omitempty,dive"` // Domains is an optional field, valid for egress Allow rules only, that restricts the rule // to apply only to traffic to one of the specified domains. If this field is specified, // Action must be Allow, and Nets and Selector must both be left empty. Domains []string `json:"domains,omitempty" validate:"omitempty,dive,wildname"` // NotNets is the negated version of the Nets field. NotNets []string `json:"notNets,omitempty" validate:"omitempty,dive,net"` // NotSelector is the negated version of the Selector field. See Selector field for // subtleties with negated selectors. NotSelector string `json:"notSelector,omitempty" validate:"omitempty,selector"` // NotPorts is the negated version of the Ports field. // Since only some protocols have ports, if any ports are specified it requires the // Protocol match in the Rule to be set to "TCP" or "UDP". NotPorts []numorstring.Port `json:"notPorts,omitempty" validate:"omitempty,dive"` // ServiceAccounts is an optional field that restricts the rule to only apply to traffic that originates from (or // terminates at) a pod running as a matching service account. ServiceAccounts *ServiceAccountMatch `json:"serviceAccounts,omitempty" validate:"omitempty"` }
An EntityRule is a sub-component of a Rule comprising the match criteria specific to a particular entity (that is either the source or destination).
A source EntityRule matches the source endpoint and originating traffic. A destination EntityRule matches the destination endpoint and terminating traffic.
func (*EntityRule) DeepCopy ¶
func (in *EntityRule) DeepCopy() *EntityRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EntityRule.
func (*EntityRule) DeepCopyInto ¶
func (in *EntityRule) DeepCopyInto(out *EntityRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ErrorCondition ¶
type ErrorCondition struct { Type string `json:"type" validate:"required"` Message string `json:"message" validate:"required"` }
func (*ErrorCondition) DeepCopy ¶
func (in *ErrorCondition) DeepCopy() *ErrorCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ErrorCondition.
func (*ErrorCondition) DeepCopyInto ¶
func (in *ErrorCondition) DeepCopyInto(out *ErrorCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type EtcdConfig ¶
type EtcdConfig struct { // A comma separated list of etcd endpoints. Valid if DatastoreType is etcdv3. [Default: ] EtcdEndpoints string `json:"etcdEndpoints,omitempty" validate:"omitempty,etcdEndpoints"` // User name for RBAC. Valid if DatastoreType is etcdv3. EtcdUsername string `json:"etcdUsername,omitempty" validate:"omitempty"` // Password for the given user name. Valid if DatastoreType is etcdv3. EtcdPassword string `json:"etcdPassword,omitempty" validate:"omitempty"` // Path to the etcd key file. Valid if DatastoreType is etcdv3. EtcdKeyFile string `json:"etcdKeyFile,omitempty" validate:"omitempty,file"` // Path to the etcd client certificate. Valid if DatastoreType is etcdv3. EtcdCertFile string `json:"etcdCertFile,omitempty" validate:"omitempty,file"` // Path to the etcd Certificate Authority file. Valid if DatastoreType is etcdv3. EtcdCACertFile string `json:"etcdCACertFile,omitempty" validate:"omitempty,file"` // These config file parameters are to support inline certificates, keys and CA / Trusted certificate. EtcdKey string `json:"etcdKey,omitempty" ignored:"true"` EtcdCert string `json:"etcdCert,omitempty" ignored:"true"` EtcdCACert string `json:"etcdCACert,omitempty" ignored:"true"` }
func (*EtcdConfig) DeepCopy ¶
func (in *EtcdConfig) DeepCopy() *EtcdConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EtcdConfig.
func (*EtcdConfig) DeepCopyInto ¶
func (in *EtcdConfig) DeepCopyInto(out *EtcdConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ExternalNetwork ¶
type ExternalNetwork struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec ExternalNetworkSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewExternalNetwork ¶
func NewExternalNetwork() *ExternalNetwork
New ExternalNetwork creates a new (zeroed) ExternalNetwork struct with the TypeMetadata initialized to the current version.
func (*ExternalNetwork) DeepCopy ¶
func (in *ExternalNetwork) DeepCopy() *ExternalNetwork
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalNetwork.
func (*ExternalNetwork) DeepCopyInto ¶
func (in *ExternalNetwork) DeepCopyInto(out *ExternalNetwork)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ExternalNetwork) DeepCopyObject ¶
func (in *ExternalNetwork) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ExternalNetworkList ¶
type ExternalNetworkList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []ExternalNetwork `json:"items" protobuf:"bytes,2,rep,name=items"` }
ExternalNetworkList is a list of ExternalNetwork resources.
func (*ExternalNetworkList) DeepCopy ¶
func (in *ExternalNetworkList) DeepCopy() *ExternalNetworkList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalNetworkList.
func (*ExternalNetworkList) DeepCopyInto ¶
func (in *ExternalNetworkList) DeepCopyInto(out *ExternalNetworkList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ExternalNetworkList) DeepCopyObject ¶
func (in *ExternalNetworkList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ExternalNetworkSpec ¶
type ExternalNetworkSpec struct { // The index of a linux kernel routing table that should be used for the routes associated with the external network. // The value should be unique for each external network. // The value should not be in the range of `RouteTableRanges` field in FelixConfiguration. // The kernel routing table index should not be used by other processes on the node. RouteTableIndex *uint32 `json:"routeTableIndex" validate:"required"` }
ExternalNetworkSpec contains the specification for a external network resource.
func (*ExternalNetworkSpec) DeepCopy ¶
func (in *ExternalNetworkSpec) DeepCopy() *ExternalNetworkSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalNetworkSpec.
func (*ExternalNetworkSpec) DeepCopyInto ¶
func (in *ExternalNetworkSpec) DeepCopyInto(out *ExternalNetworkSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type FailureDetectionMode ¶
type FailureDetectionMode string
const ( FailureDetectionModeNone FailureDetectionMode = "None" FailureDetectionModeBFDIfDirectlyConnected FailureDetectionMode = "BFDIfDirectlyConnected" )
type FederatedServicesControllerConfig ¶
type FederatedServicesControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` }
FederatedServicesControllerConfig configures the federated services controller, which syncs Kubernetes services from remote clusters.
func (*FederatedServicesControllerConfig) DeepCopy ¶
func (in *FederatedServicesControllerConfig) DeepCopy() *FederatedServicesControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FederatedServicesControllerConfig.
func (*FederatedServicesControllerConfig) DeepCopyInto ¶
func (in *FederatedServicesControllerConfig) DeepCopyInto(out *FederatedServicesControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type FelixConfiguration ¶
type FelixConfiguration struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec FelixConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewFelixConfiguration ¶
func NewFelixConfiguration() *FelixConfiguration
New FelixConfiguration creates a new (zeroed) FelixConfiguration struct with the TypeMetadata initialized to the current version.
func (*FelixConfiguration) DeepCopy ¶
func (in *FelixConfiguration) DeepCopy() *FelixConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FelixConfiguration.
func (*FelixConfiguration) DeepCopyInto ¶
func (in *FelixConfiguration) DeepCopyInto(out *FelixConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*FelixConfiguration) DeepCopyObject ¶
func (in *FelixConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type FelixConfigurationList ¶
type FelixConfigurationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []FelixConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` }
FelixConfigurationList contains a list of FelixConfiguration object.
func (*FelixConfigurationList) DeepCopy ¶
func (in *FelixConfigurationList) DeepCopy() *FelixConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FelixConfigurationList.
func (*FelixConfigurationList) DeepCopyInto ¶
func (in *FelixConfigurationList) DeepCopyInto(out *FelixConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*FelixConfigurationList) DeepCopyObject ¶
func (in *FelixConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type FelixConfigurationSpec ¶
type FelixConfigurationSpec struct { // UseInternalDataplaneDriver, if true, Felix will use its internal dataplane programming logic. If false, it // will launch an external dataplane driver and communicate with it over protobuf. UseInternalDataplaneDriver *bool `json:"useInternalDataplaneDriver,omitempty"` // DataplaneDriver filename of the external dataplane driver to use. Only used if UseInternalDataplaneDriver // is set to false. DataplaneDriver string `json:"dataplaneDriver,omitempty"` // DataplaneWatchdogTimeout is the readiness/liveness timeout used for Felix's (internal) dataplane driver. // Increase this value if you experience spurious non-ready or non-live events when Felix is under heavy load. // Decrease the value to get felix to report non-live or non-ready more quickly. [Default: 90s] // // Deprecated: replaced by the generic HealthTimeoutOverrides. DataplaneWatchdogTimeout *metav1.Duration `json:"dataplaneWatchdogTimeout,omitempty" configv1timescale:"seconds"` // IPv6Support controls whether Felix enables support for IPv6 (if supported by the in-use dataplane). IPv6Support *bool `json:"ipv6Support,omitempty" confignamev1:"Ipv6Support"` // RouteRefreshInterval is the period at which Felix re-checks the routes // in the dataplane to ensure that no other process has accidentally broken Calico's rules. // Set to 0 to disable route refresh. [Default: 90s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` RouteRefreshInterval *metav1.Duration `json:"routeRefreshInterval,omitempty" configv1timescale:"seconds"` // InterfaceRefreshInterval is the period at which Felix rescans local interfaces to verify their state. // The rescan can be disabled by setting the interval to 0. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` InterfaceRefreshInterval *metav1.Duration `json:"interfaceRefreshInterval,omitempty" configv1timescale:"seconds"` // IptablesRefreshInterval is the period at which Felix re-checks the IP sets // in the dataplane to ensure that no other process has accidentally broken Calico's rules. // Set to 0 to disable IP sets refresh. Note: the default for this value is lower than the // other refresh intervals as a workaround for a Linux kernel bug that was fixed in kernel // version 4.11. If you are using v4.11 or greater you may want to set this to, a higher value // to reduce Felix CPU usage. [Default: 10s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IptablesRefreshInterval *metav1.Duration `json:"iptablesRefreshInterval,omitempty" configv1timescale:"seconds"` // IptablesPostWriteCheckInterval is the period after Felix has done a write // to the dataplane that it schedules an extra read back in order to check the write was not // clobbered by another process. This should only occur if another application on the system // doesn't respect the iptables lock. [Default: 1s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IptablesPostWriteCheckInterval *metav1.Duration `json:"iptablesPostWriteCheckInterval,omitempty" configv1timescale:"seconds" confignamev1:"IptablesPostWriteCheckIntervalSecs"` // IptablesLockFilePath is the location of the iptables lock file. You may need to change this // if the lock file is not in its standard location (for example if you have mapped it into Felix's // container at a different path). [Default: /run/xtables.lock] IptablesLockFilePath string `json:"iptablesLockFilePath,omitempty"` // IptablesLockTimeout is the time that Felix will wait for the iptables lock, // or 0, to disable. To use this feature, Felix must share the iptables lock file with all other // processes that also take the lock. When running Felix inside a container, this requires the // /run directory of the host to be mounted into the calico/node or calico/felix container. // [Default: 0s disabled] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IptablesLockTimeout *metav1.Duration `json:"iptablesLockTimeout,omitempty" configv1timescale:"seconds" confignamev1:"IptablesLockTimeoutSecs"` // IptablesLockProbeInterval is the time that Felix will wait between // attempts to acquire the iptables lock if it is not available. Lower values make Felix more // responsive when the lock is contended, but use more CPU. [Default: 50ms] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IptablesLockProbeInterval *metav1.Duration `json:"iptablesLockProbeInterval,omitempty" configv1timescale:"milliseconds" confignamev1:"IptablesLockProbeIntervalMillis"` // FeatureDetectOverride is used to override feature detection based on auto-detected platform // capabilities. Values are specified in a comma separated list with no spaces, example; // "SNATFullyRandom=true,MASQFullyRandom=false,RestoreSupportsLock=". "true" or "false" will // force the feature, empty or omitted values are auto-detected. // +kubebuilder:validation:Pattern=`^([a-zA-Z0-9-_]+=(true|false|),)*([a-zA-Z0-9-_]+=(true|false|))?$` FeatureDetectOverride string `json:"featureDetectOverride,omitempty" validate:"omitempty,keyValueList"` // FeatureGates is used to enable or disable tech-preview Calico features. // Values are specified in a comma separated list with no spaces, example; // "BPFConnectTimeLoadBalancingWorkaround=enabled,XyZ=false". This is // used to enable features that are not fully production ready. // +kubebuilder:validation:Pattern=`^([a-zA-Z0-9-_]+=([^=]+),)*([a-zA-Z0-9-_]+=([^=]+))?$` FeatureGates string `json:"featureGates,omitempty" validate:"omitempty,keyValueList"` // IpsetsRefreshInterval is the period at which Felix re-checks all iptables // state to ensure that no other process has accidentally broken Calico's rules. Set to 0 to // disable iptables refresh. [Default: 90s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IpsetsRefreshInterval *metav1.Duration `json:"ipsetsRefreshInterval,omitempty" configv1timescale:"seconds"` MaxIpsetSize *int `json:"maxIpsetSize,omitempty"` // IptablesBackend specifies which backend of iptables will be used. The default is Auto. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^(?i)(Auto|FelixConfiguration|FelixConfigurationList|Legacy|NFT)?$` IptablesBackend *IptablesBackend `json:"iptablesBackend,omitempty" validate:"omitempty,iptablesBackend"` // XDPRefreshInterval is the period at which Felix re-checks all XDP state to ensure that no // other process has accidentally broken Calico's BPF maps or attached programs. Set to 0 to // disable XDP refresh. [Default: 90s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` XDPRefreshInterval *metav1.Duration `json:"xdpRefreshInterval,omitempty" configv1timescale:"seconds"` // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` NetlinkTimeout *metav1.Duration `json:"netlinkTimeout,omitempty" configv1timescale:"seconds" confignamev1:"NetlinkTimeoutSecs"` // MetadataAddr is the IP address or domain name of the server that can answer VM queries for // cloud-init metadata. In OpenStack, this corresponds to the machine running nova-api (or in // Ubuntu, nova-api-metadata). A value of none (case-insensitive) means that Felix should not // set up any NAT rule for the metadata path. [Default: 127.0.0.1] MetadataAddr string `json:"metadataAddr,omitempty"` // MetadataPort is the port of the metadata server. This, combined with global.MetadataAddr (if // not 'None'), is used to set up a NAT rule, from 169.254.169.254:80 to MetadataAddr:MetadataPort. // In most cases this should not need to be changed [Default: 8775]. MetadataPort *int `json:"metadataPort,omitempty"` // OpenstackRegion is the name of the region that a particular Felix belongs to. In a multi-region // Calico/OpenStack deployment, this must be configured somehow for each Felix (here in the datamodel, // or in felix.cfg or the environment on each compute node), and must match the [calico] // openstack_region value configured in neutron.conf on each node. [Default: Empty] OpenstackRegion string `json:"openstackRegion,omitempty"` // InterfacePrefix is the interface name prefix that identifies workload endpoints and so distinguishes // them from host endpoint interfaces. Note: in environments other than bare metal, the orchestrators // configure this appropriately. For example our Kubernetes and Docker integrations set the 'cali' value, // and our OpenStack integration sets the 'tap' value. [Default: cali] InterfacePrefix string `json:"interfacePrefix,omitempty"` // InterfaceExclude is a comma-separated list of interfaces that Felix should exclude when monitoring for host // endpoints. The default value ensures that Felix ignores Kubernetes' IPVS dummy interface, which is used // internally by kube-proxy. If you want to exclude multiple interface names using a single value, the list // supports regular expressions. For regular expressions you must wrap the value with '/'. For example // having values '/^kube/,veth1' will exclude all interfaces that begin with 'kube' and also the interface // 'veth1'. [Default: kube-ipvs0] InterfaceExclude string `json:"interfaceExclude,omitempty"` // ChainInsertMode controls whether Felix hooks the kernel's top-level iptables chains by inserting a rule // at the top of the chain or by appending a rule at the bottom. insert is the safe default since it prevents // Calico's rules from being bypassed. If you switch to append mode, be sure that the other rules in the chains // signal acceptance by falling through to the Calico rules, otherwise the Calico policy will be bypassed. // [Default: insert] // +kubebuilder:validation:Pattern=`^(?i)(insert|append)?$` ChainInsertMode string `json:"chainInsertMode,omitempty"` // DefaultEndpointToHostAction controls what happens to traffic that goes from a workload endpoint to the host // itself (after the traffic hits the endpoint egress policy). By default Calico blocks traffic from workload // endpoints to the host itself with an iptables "DROP" action. If you want to allow some or all traffic from // endpoint to host, set this parameter to RETURN or ACCEPT. Use RETURN if you have your own rules in the iptables // "INPUT" chain; Calico will insert its rules at the top of that chain, then "RETURN" packets to the "INPUT" chain // once it has completed processing workload endpoint egress policy. Use ACCEPT to unconditionally accept packets // from workloads after processing workload endpoint egress policy. [Default: Drop] // +kubebuilder:validation:Pattern=`^(?i)(Drop|Accept|Return)?$` DefaultEndpointToHostAction string `json:"defaultEndpointToHostAction,omitempty" validate:"omitempty,dropAcceptReturn"` // +kubebuilder:validation:Pattern=`^(?i)(Accept|Return)?$` IptablesFilterAllowAction string `json:"iptablesFilterAllowAction,omitempty" validate:"omitempty,acceptReturn"` // +kubebuilder:validation:Pattern=`^(?i)(Accept|Return)?$` IptablesMangleAllowAction string `json:"iptablesMangleAllowAction,omitempty" validate:"omitempty,acceptReturn"` // IptablesFilterDenyAction controls what happens to traffic that is denied by network policy. By default Calico blocks traffic // with an iptables "DROP" action. If you want to use "REJECT" action instead you can configure it in here. // +kubebuilder:validation:Pattern=`^(?i)(Drop|Reject)?$` IptablesFilterDenyAction string `json:"iptablesFilterDenyAction,omitempty" validate:"omitempty,dropReject"` // LogPrefix is the log prefix that Felix uses when rendering LOG rules. [Default: calico-packet] LogPrefix string `json:"logPrefix,omitempty"` // LogDropActionOverride specifies whether or not to include the DropActionOverride in the logs when it is triggered. LogDropActionOverride *bool `json:"logDropActionOverride,omitempty"` // LogFilePath is the full path to the Felix log. Set to none to disable file logging. [Default: /var/log/calico/felix.log] LogFilePath string `json:"logFilePath,omitempty"` // LogSeverityFile is the log severity above which logs are sent to the log file. [Default: Info] // +kubebuilder:validation:Pattern=`^(?i)(Debug|Info|Warning|Error|Fatal)?$` LogSeverityFile string `json:"logSeverityFile,omitempty" validate:"omitempty,logLevel"` // LogSeverityScreen is the log severity above which logs are sent to the stdout. [Default: Info] // +kubebuilder:validation:Pattern=`^(?i)(Debug|Info|Warning|Error|Fatal)?$` LogSeverityScreen string `json:"logSeverityScreen,omitempty" validate:"omitempty,logLevel"` // LogSeveritySys is the log severity above which logs are sent to the syslog. Set to None for no logging to syslog. // [Default: Info] // +kubebuilder:validation:Pattern=`^(?i)(Debug|Info|Warning|Error|Fatal)?$` LogSeveritySys string `json:"logSeveritySys,omitempty" validate:"omitempty,logLevel"` // LogDebugFilenameRegex controls which source code files have their Debug log output included in the logs. // Only logs from files with names that match the given regular expression are included. The filter only applies // to Debug level logs. LogDebugFilenameRegex string `json:"logDebugFilenameRegex,omitempty" validate:"omitempty,regexp"` // IPIPEnabled overrides whether Felix should configure an IPIP interface on the host. Optional as Felix determines this based on the existing IP pools. [Default: nil (unset)] IPIPEnabled *bool `json:"ipipEnabled,omitempty" confignamev1:"IpInIpEnabled"` // IPIPMTU is the MTU to set on the tunnel device. See Configuring MTU [Default: 1440] IPIPMTU *int `json:"ipipMTU,omitempty" confignamev1:"IpInIpMtu"` // VXLANEnabled overrides whether Felix should create the VXLAN tunnel device for IPv4 VXLAN networking. Optional as Felix determines this based on the existing IP pools. [Default: nil (unset)] VXLANEnabled *bool `json:"vxlanEnabled,omitempty" confignamev1:"VXLANEnabled"` // VXLANMTU is the MTU to set on the IPv4 VXLAN tunnel device. See Configuring MTU [Default: 1410] VXLANMTU *int `json:"vxlanMTU,omitempty"` // VXLANMTUV6 is the MTU to set on the IPv6 VXLAN tunnel device. See Configuring MTU [Default: 1390] VXLANMTUV6 *int `json:"vxlanMTUV6,omitempty"` VXLANPort *int `json:"vxlanPort,omitempty"` VXLANVNI *int `json:"vxlanVNI,omitempty"` // AllowVXLANPacketsFromWorkloads controls whether Felix will add a rule to drop VXLAN encapsulated traffic // from workloads [Default: false] // +optional AllowVXLANPacketsFromWorkloads *bool `json:"allowVXLANPacketsFromWorkloads,omitempty"` // AllowIPIPPacketsFromWorkloads controls whether Felix will add a rule to drop IPIP encapsulated traffic // from workloads [Default: false] // +optional AllowIPIPPacketsFromWorkloads *bool `json:"allowIPIPPacketsFromWorkloads,omitempty"` // ReportingInterval is the interval at which Felix reports its status into the datastore or 0 to disable. // Must be non-zero in OpenStack deployments. [Default: 30s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` ReportingInterval *metav1.Duration `json:"reportingInterval,omitempty" configv1timescale:"seconds" confignamev1:"ReportingIntervalSecs"` // ReportingTTL is the time-to-live setting for process-wide status reports. [Default: 90s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` ReportingTTL *metav1.Duration `json:"reportingTTL,omitempty" configv1timescale:"seconds" confignamev1:"ReportingTTLSecs"` EndpointReportingEnabled *bool `json:"endpointReportingEnabled,omitempty"` // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` EndpointReportingDelay *metav1.Duration `json:"endpointReportingDelay,omitempty" configv1timescale:"seconds" confignamev1:"EndpointReportingDelaySecs"` // IptablesMarkMask is the mask that Felix selects its IPTables Mark bits from. Should be a 32 bit hexadecimal // number with at least 8 bits set, none of which clash with any other mark bits in use on the system. // [Default: 0xffff0000] IptablesMarkMask *uint32 `json:"iptablesMarkMask,omitempty"` DisableConntrackInvalidCheck *bool `json:"disableConntrackInvalidCheck,omitempty"` HealthEnabled *bool `json:"healthEnabled,omitempty"` HealthHost *string `json:"healthHost,omitempty"` HealthPort *int `json:"healthPort,omitempty"` // HealthTimeoutOverrides allows the internal watchdog timeouts of individual subcomponents to be // overridden. This is useful for working around "false positive" liveness timeouts that can occur // in particularly stressful workloads or if CPU is constrained. For a list of active // subcomponents, see Felix's logs. HealthTimeoutOverrides []HealthTimeoutOverride `json:"healthTimeoutOverrides,omitempty" validate:"omitempty,dive"` // PrometheusMetricsEnabled enables the Prometheus metrics server in Felix if set to true. [Default: false] PrometheusMetricsEnabled *bool `json:"prometheusMetricsEnabled,omitempty"` // PrometheusMetricsHost is the host that the Prometheus metrics server should bind to. [Default: empty] PrometheusMetricsHost string `json:"prometheusMetricsHost,omitempty" validate:"omitempty,prometheusHost"` // PrometheusMetricsPort is the TCP port that the Prometheus metrics server should bind to. [Default: 9091] PrometheusMetricsPort *int `json:"prometheusMetricsPort,omitempty"` // PrometheusGoMetricsEnabled disables Go runtime metrics collection, which the Prometheus client does by default, when // set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true] PrometheusGoMetricsEnabled *bool `json:"prometheusGoMetricsEnabled,omitempty"` // PrometheusProcessMetricsEnabled disables process metrics collection, which the Prometheus client does by default, when // set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true] PrometheusProcessMetricsEnabled *bool `json:"prometheusProcessMetricsEnabled,omitempty"` // PrometheusWireGuardMetricsEnabled disables wireguard metrics collection, which the Prometheus client does by default, when // set to false. This reduces the number of metrics reported, reducing Prometheus load. [Default: true] PrometheusWireGuardMetricsEnabled *bool `json:"prometheusWireGuardMetricsEnabled,omitempty"` // TLS credentials for this port. PrometheusMetricsCertFile string `json:"prometheusMetricsCertFile,omitempty"` PrometheusMetricsKeyFile string `json:"prometheusMetricsKeyFile,omitempty"` PrometheusMetricsCAFile string `json:"prometheusMetricsCAFile,omitempty"` // FailsafeInboundHostPorts is a list of UDP/TCP ports and CIDRs that Felix will allow incoming traffic to host endpoints // on irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. // For back-compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow // traffic from all addresses. To disable all inbound host ports, use the value none. The default value allows ssh access // and DHCP. // [Default: tcp:22, udp:68, tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667] FailsafeInboundHostPorts *[]ProtoPort `json:"failsafeInboundHostPorts,omitempty"` // FailsafeOutboundHostPorts is a list of UDP/TCP ports and CIDRs that Felix will allow outgoing traffic from host endpoints // to irrespective of the security policy. This is useful to avoid accidentally cutting off a host with incorrect configuration. // For back-compatibility, if the protocol is not specified, it defaults to "tcp". If a CIDR is not specified, it will allow // traffic from all addresses. To disable all outbound host ports, use the value none. The default value opens etcd's standard // ports to ensure that Felix does not get cut off from etcd as well as allowing DHCP and DNS. // [Default: tcp:179, tcp:2379, tcp:2380, tcp:6443, tcp:6666, tcp:6667, udp:53, udp:67] FailsafeOutboundHostPorts *[]ProtoPort `json:"failsafeOutboundHostPorts,omitempty"` // KubeMasqueradeBit should be set to the same value as --iptables-masquerade-bit of kube-proxy // when TPROXY is used. The default is the same as kube-proxy default thus only needs a change // if kube-proxy is using a non-standard setting. Must be within the range of 0-31. [Default: 14] KubeMasqueradeBit *int `json:"kubeMasqueradeBit,omitempty" validate:"omitempty,gte=0,lte=31"` // KubeNodePortRanges holds list of port ranges used for service node ports. Only used if felix detects kube-proxy running in ipvs mode. // Felix uses these ranges to separate host and workload traffic. [Default: 30000:32767]. KubeNodePortRanges *[]numorstring.Port `json:"kubeNodePortRanges,omitempty" validate:"omitempty,dive"` // PolicySyncPathPrefix is used to by Felix to communicate policy changes to external services, // like Application layer policy. [Default: Empty] PolicySyncPathPrefix string `json:"policySyncPathPrefix,omitempty"` // UsageReportingEnabled reports anonymous Calico version number and cluster size to projectcalico.org. Logs warnings returned by the usage // server. For example, if a significant security vulnerability has been discovered in the version of Calico being used. [Default: true] UsageReportingEnabled *bool `json:"usageReportingEnabled,omitempty"` // UsageReportingInitialDelay controls the minimum delay before Felix makes a report. [Default: 300s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` UsageReportingInitialDelay *metav1.Duration `json:"usageReportingInitialDelay,omitempty" configv1timescale:"seconds" confignamev1:"UsageReportingInitialDelaySecs"` // UsageReportingInterval controls the interval at which Felix makes reports. [Default: 86400s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` UsageReportingInterval *metav1.Duration `json:"usageReportingInterval,omitempty" configv1timescale:"seconds" confignamev1:"UsageReportingIntervalSecs"` // NATPortRange specifies the range of ports that is used for port mapping when doing outgoing NAT. When unset the default behavior of the // network stack is used. NATPortRange *numorstring.Port `json:"natPortRange,omitempty"` // NATOutgoingAddress specifies an address to use when performing source NAT for traffic in a natOutgoing pool that // is leaving the network. By default the address used is an address on the interface the traffic is leaving on // (ie it uses the iptables MASQUERADE target) NATOutgoingAddress string `json:"natOutgoingAddress,omitempty"` // This is the IPv4 source address to use on programmed device routes. By default the source address is left blank, // leaving the kernel to choose the source address used. DeviceRouteSourceAddress string `json:"deviceRouteSourceAddress,omitempty"` // This is the IPv6 source address to use on programmed device routes. By default the source address is left blank, // leaving the kernel to choose the source address used. DeviceRouteSourceAddressIPv6 string `json:"deviceRouteSourceAddressIPv6,omitempty"` // This defines the route protocol added to programmed device routes, by default this will be RTPROT_BOOT // when left blank. DeviceRouteProtocol *int `json:"deviceRouteProtocol,omitempty"` // Whether or not to remove device routes that have not been programmed by Felix. Disabling this will allow external // applications to also add device routes. This is enabled by default which means we will remove externally added routes. RemoveExternalRoutes *bool `json:"removeExternalRoutes,omitempty"` // ExternalNodesCIDRList is a list of CIDR's of external-non-calico-nodes which may source tunnel traffic and have // the tunneled traffic be accepted at calico nodes. ExternalNodesCIDRList *[]string `json:"externalNodesList,omitempty"` NfNetlinkBufSize string `json:"nfNetlinkBufSize,omitempty"` StatsDumpFilePath string `json:"statsDumpFilePath,omitempty"` // Felix Denied Packet Metrics configuration parameters. PrometheusReporterEnabled *bool `json:"prometheusReporterEnabled,omitempty"` PrometheusReporterPort *int `json:"prometheusReporterPort,omitempty"` PrometheusReporterCertFile string `json:"prometheusReporterCertFile,omitempty"` PrometheusReporterKeyFile string `json:"prometheusReporterKeyFile,omitempty"` PrometheusReporterCAFile string `json:"prometheusReporterCAFile,omitempty"` DeletedMetricsRetentionSecs *int `json:"deletedMetricsRetentionSecs,omitempty"` // DropActionOverride overrides the Drop action in Felix, optionally changing the behavior to Accept, and optionally adding Log. // Possible values are Drop, LogAndDrop, Accept, LogAndAccept. [Default: Drop] // +kubebuilder:validation:Pattern=`^(?i)(Drop|LogAndDrop|Accept|LogAndAccept)?$` DropActionOverride string `json:"dropActionOverride,omitempty" validate:"omitempty,dropActionOverride"` DebugMemoryProfilePath string `json:"debugMemoryProfilePath,omitempty"` DebugDisableLogDropping *bool `json:"debugDisableLogDropping,omitempty"` // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DebugSimulateCalcGraphHangAfter *metav1.Duration `json:"debugSimulateCalcGraphHangAfter,omitempty" configv1timescale:"seconds"` // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DebugSimulateDataplaneHangAfter *metav1.Duration `json:"debugSimulateDataplaneHangAfter,omitempty" configv1timescale:"seconds"` // DebugHost is the host IP or hostname to bind the debug port to. Only used // if DebugPort is set. [Default:localhost] DebugHost *string `json:"debugHost,omitempty"` // DebugPort if set, enables Felix's debug HTTP port, which allows memory and CPU profiles // to be retrieved. The debug port is not secure, it should not be exposed to the internet. DebugPort *int `json:"debugPort,omitempty" validate:"omitempty,gte=0,lte=65535"` IptablesNATOutgoingInterfaceFilter string `json:"iptablesNATOutgoingInterfaceFilter,omitempty" validate:"omitempty,ifaceFilter"` // SidecarAccelerationEnabled enables experimental sidecar acceleration [Default: false] SidecarAccelerationEnabled *bool `json:"sidecarAccelerationEnabled,omitempty"` // XDPEnabled enables XDP acceleration for suitable untracked incoming deny rules. [Default: true] XDPEnabled *bool `json:"xdpEnabled,omitempty" confignamev1:"XDPEnabled"` // GenericXDPEnabled enables Generic XDP so network cards that don't support XDP offload or driver // modes can use XDP. This is not recommended since it doesn't provide better performance than // iptables. [Default: false] GenericXDPEnabled *bool `json:"genericXDPEnabled,omitempty" confignamev1:"GenericXDPEnabled"` // BPFEnabled, if enabled Felix will use the BPF dataplane. [Default: false] BPFEnabled *bool `json:"bpfEnabled,omitempty" validate:"omitempty"` // BPFDisableUnprivileged, if enabled, Felix sets the kernel.unprivileged_bpf_disabled sysctl to disable // unprivileged use of BPF. This ensures that unprivileged users cannot access Calico's BPF maps and // cannot insert their own BPF programs to interfere with Calico's. [Default: true] BPFDisableUnprivileged *bool `json:"bpfDisableUnprivileged,omitempty" validate:"omitempty"` // BPFLogLevel controls the log level of the BPF programs when in BPF dataplane mode. One of "Off", "Info", or // "Debug". The logs are emitted to the BPF trace pipe, accessible with the command `tc exec bpf debug`. // [Default: Off]. // +optional // +kubebuilder:validation:Pattern=`^(?i)(Off|Info|Debug)?$` BPFLogLevel string `json:"bpfLogLevel,omitempty" validate:"omitempty,bpfLogLevel"` // BPFLogFilters is a map of key=values where the value is // a pcap filter expression and the key is an interface name with 'all' // denoting all interfaces, 'weps' all workload endpoints and 'heps' all host // endpoints. // // When specified as an env var, it accepts a comma-separated list of // key=values. // [Default: unset - means all debug logs are emitted] // +optional BPFLogFilters *map[string]string `json:"bpfLogFilters,omitempty" validate:"omitempty,bpfLogFilters"` // BPFCTLBLogFilter specifies, what is logged by connect time load balancer when BPFLogLevel is // debug. Currently has to be specified as 'all' when BPFLogFilters is set // to see CTLB logs. // [Default: unset - means logs are emitted when BPFLogLevel id debug and BPFLogFilters not set.] // +optional BPFCTLBLogFilter string `json:"bpfCTLBLogFilter,omitempty" validate:"omitempty"` // BPFDataIfacePattern is a regular expression that controls which interfaces Felix should attach BPF programs to // in order to catch traffic to/from the network. This needs to match the interfaces that Calico workload traffic // flows over as well as any interfaces that handle incoming traffic to nodeports and services from outside the // cluster. It should not match the workload interfaces (usually named cali...). BPFDataIfacePattern string `json:"bpfDataIfacePattern,omitempty" validate:"omitempty,regexp"` // BPFL3IfacePattern is a regular expression that allows to list tunnel devices like wireguard or vxlan (i.e., L3 devices) // in addition to BPFDataIfacePattern. That is, tunnel interfaces not created by Calico, that Calico workload traffic flows // over as well as any interfaces that handle incoming traffic to nodeports and services from outside the cluster. BPFL3IfacePattern string `json:"bpfL3IfacePattern,omitempty" validate:"omitempty,regexp"` // BPFConnectTimeLoadBalancingEnabled when in BPF mode, controls whether Felix installs the connection-time load // balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services // and it improves the performance of pod-to-service connections. The only reason to disable it is for debugging // purposes. This will be deprecated. Use BPFConnectTimeLoadBalancing [Default: true] BPFConnectTimeLoadBalancingEnabled *bool `json:"bpfConnectTimeLoadBalancingEnabled,omitempty" validate:"omitempty"` // BPFConnectTimeLoadBalancing when in BPF mode, controls whether Felix installs the connect-time load // balancer. The connect-time load balancer is required for the host to be able to reach Kubernetes services // and it improves the performance of pod-to-service connections.When set to TCP, connect time load balancing // is available only for services with TCP ports. [Default: TCP] BPFConnectTimeLoadBalancing *BPFConnectTimeLBType `json:"bpfConnectTimeLoadBalancing,omitempty" validate:"omitempty,oneof=TCP Enabled Disabled"` // BPFHostNetworkedNATWithoutCTLB when in BPF mode, controls whether Felix does a NAT without CTLB. This along with BPFConnectTimeLoadBalancing // determines the CTLB behavior. [Default: Enabled] BPFHostNetworkedNATWithoutCTLB *BPFHostNetworkedNATType `json:"bpfHostNetworkedNATWithoutCTLB,omitempty" validate:"omitempty,oneof=Enabled Disabled"` // BPFExternalServiceMode in BPF mode, controls how connections from outside the cluster to services (node ports // and cluster IPs) are forwarded to remote workloads. If set to "Tunnel" then both request and response traffic // is tunneled to the remote node. If set to "DSR", the request traffic is tunneled but the response traffic // is sent directly from the remote node. In "DSR" mode, the remote node appears to use the IP of the ingress // node; this requires a permissive L2 network. [Default: Tunnel] // +kubebuilder:validation:Pattern=`^(?i)(Tunnel|DSR)?$` BPFExternalServiceMode string `json:"bpfExternalServiceMode,omitempty" validate:"omitempty,bpfServiceMode"` // BPFDSROptoutCIDRs is a list of CIDRs which are excluded from DSR. That is, clients // in those CIDRs will accesses nodeports as if BPFExternalServiceMode was set to // Tunnel. BPFDSROptoutCIDRs *[]string `json:"bpfDSROptoutCIDRs,omitempty" validate:"omitempty,cidrs"` // BPFExtToServiceConnmark in BPF mode, control a 32bit mark that is set on connections from an // external client to a local service. This mark allows us to control how packets of that // connection are routed within the host and how is routing interpreted by RPF check. [Default: 0] BPFExtToServiceConnmark *int `json:"bpfExtToServiceConnmark,omitempty" validate:"omitempty,gte=0,lte=4294967295"` // BPFKubeProxyIptablesCleanupEnabled, if enabled in BPF mode, Felix will proactively clean up the upstream // Kubernetes kube-proxy's iptables chains. Should only be enabled if kube-proxy is not running. [Default: true] BPFKubeProxyIptablesCleanupEnabled *bool `json:"bpfKubeProxyIptablesCleanupEnabled,omitempty" validate:"omitempty"` // BPFKubeProxyMinSyncPeriod, in BPF mode, controls the minimum time between updates to the dataplane for Felix's // embedded kube-proxy. Lower values give reduced set-up latency. Higher values reduce Felix CPU usage by // batching up more work. [Default: 1s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` BPFKubeProxyMinSyncPeriod *metav1.Duration `json:"bpfKubeProxyMinSyncPeriod,omitempty" validate:"omitempty" configv1timescale:"seconds"` // BPFKubeProxyEndpointSlicesEnabled is deprecated and has no effect. BPF // kube-proxy always accepts endpoint slices. This option will be removed in // the next release. BPFKubeProxyEndpointSlicesEnabled *bool `json:"bpfKubeProxyEndpointSlicesEnabled,omitempty" validate:"omitempty"` // BPFPSNATPorts sets the range from which we randomly pick a port if there is a source port // collision. This should be within the ephemeral range as defined by RFC 6056 (1024–65535) and // preferably outside the ephemeral ranges used by common operating systems. Linux uses // 32768–60999, while others mostly use the IANA defined range 49152–65535. It is not necessarily // a problem if this range overlaps with the operating systems. Both ends of the range are // inclusive. [Default: 20000:29999] BPFPSNATPorts *numorstring.Port `json:"bpfPSNATPorts,omitempty"` // BPFMapSizeNATFrontend sets the size for nat front end map. // FrontendMap should be large enough to hold an entry for each nodeport, // external IP and each port in each service. BPFMapSizeNATFrontend *int `json:"bpfMapSizeNATFrontend,omitempty"` // BPFMapSizeNATBackend sets the size for nat back end map. // This is the total number of endpoints. This is mostly // more than the size of the number of services. BPFMapSizeNATBackend *int `json:"bpfMapSizeNATBackend,omitempty"` BPFMapSizeNATAffinity *int `json:"bpfMapSizeNATAffinity,omitempty"` // BPFMapSizeRoute sets the size for the routes map. The routes map should be large enough // to hold one entry per workload and a handful of entries per host (enough to cover its own IPs and // tunnel IPs). BPFMapSizeRoute *int `json:"bpfMapSizeRoute,omitempty"` // BPFMapSizeConntrack sets the size for the conntrack map. This map must be large enough to hold // an entry for each active connection. Warning: changing the size of the conntrack map can cause disruption. BPFMapSizeConntrack *int `json:"bpfMapSizeConntrack,omitempty"` // BPFMapSizeIPSets sets the size for ipsets map. The IP sets map must be large enough to hold an entry // for each endpoint matched by every selector in the source/destination matches in network policy. Selectors // such as "all()" can result in large numbers of entries (one entry per endpoint in that case). BPFMapSizeIPSets *int `json:"bpfMapSizeIPSets,omitempty"` // BPFMapSizeIfState sets the size for ifstate map. The ifstate map must be large enough to hold an entry // for each device (host + workloads) on a host. BPFMapSizeIfState *int `json:"bpfMapSizeIfState,omitempty"` // BPFHostConntrackBypass Controls whether to bypass Linux conntrack in BPF mode for // workloads and services. [Default: true - bypass Linux conntrack] BPFHostConntrackBypass *bool `json:"bpfHostConntrackBypass,omitempty"` // BPFEnforceRPF enforce strict RPF on all host interfaces with BPF programs regardless of // what is the per-interfaces or global setting. Possible values are Disabled, Strict // or Loose. [Default: Loose] // +kubebuilder:validation:Pattern=`^(?i)(Disabled|Strict|Loose)?$` BPFEnforceRPF string `json:"bpfEnforceRPF,omitempty"` // BPFPolicyDebugEnabled when true, Felix records detailed information // about the BPF policy programs, which can be examined with the calico-bpf command-line tool. BPFPolicyDebugEnabled *bool `json:"bpfPolicyDebugEnabled,omitempty"` // BPFForceTrackPacketsFromIfaces in BPF mode, forces traffic from these interfaces // to skip Calico's iptables NOTRACK rule, allowing traffic from those interfaces to be // tracked by Linux conntrack. Should only be used for interfaces that are not used for // the Calico fabric. For example, a docker bridge device for non-Calico-networked // containers. [Default: docker+] BPFForceTrackPacketsFromIfaces *[]string `json:"bpfForceTrackPacketsFromIfaces,omitempty" validate:"omitempty,ifaceFilterSlice"` // BPFDisableGROForIfaces is a regular expression that controls which interfaces Felix should disable the // Generic Receive Offload [GRO] option. It should not match the workload interfaces (usually named cali...). BPFDisableGROForIfaces string `json:"bpfDisableGROForIfaces,omitempty" validate:"omitempty,regexp"` // BPFExcludeCIDRsFromNAT is a list of CIDRs that are to be excluded from NAT // resolution so that host can handle them. A typical usecase is node local // DNS cache. BPFExcludeCIDRsFromNAT *[]string `json:"bpfExcludeCIDRsFromNAT,omitempty" validate:"omitempty,cidrs"` SyslogReporterNetwork string `json:"syslogReporterNetwork,omitempty"` SyslogReporterAddress string `json:"syslogReporterAddress,omitempty"` // IPSecMode controls which mode IPSec is operating on. // Default value means IPSec is not enabled. [Default: ""] IPSecMode string `json:"ipsecMode,omitempty" validate:"omitempty,ipsecMode"` // IPSecAllowUnsecuredTraffic controls whether non-IPsec traffic is allowed in addition to IPsec traffic. Enabling this // negates the anti-spoofing protections of IPsec but it is useful when migrating to/from IPsec. [Default: false] IPSecAllowUnsecuredTraffic *bool `json:"ipsecAllowUnsecuredTraffic,omitempty"` // IPSecIKEAlgorithm sets IPSec IKE algorithm. Default is NIST suite B recommendation. [Default: aes128gcm16-prfsha256-ecp256] IPSecIKEAlgorithm string `json:"ipsecIKEAlgorithm,omitempty"` // IPSecESAlgorithm sets IPSec ESP algorithm. Default is NIST suite B recommendation. [Default: aes128gcm16-ecp256] IPSecESPAlgorithm string `json:"ipsecESPAlgorithm,omitempty"` // IPSecLogLevel controls log level for IPSec components. Set to None for no logging. // A generic log level terminology is used [None, Notice, Info, Debug, Verbose]. // [Default: Info] // +kubebuilder:validation:Pattern=`^(?i)(None|Notice|Info|Debug|Verbose)?$` IPSecLogLevel string `json:"ipsecLogLevel,omitempty" validate:"omitempty,ipsecLogLevel"` // IPSecPolicyRefreshInterval is the interval at which Felix will check the kernel's IPsec policy tables and // repair any inconsistencies. [Default: 600s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` IPSecPolicyRefreshInterval *metav1.Duration `json:"ipsecPolicyRefreshInterval,omitempty" configv1timescale:"seconds"` // FlowLogsFlushInterval configures the interval at which Felix exports flow logs. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` FlowLogsFlushInterval *metav1.Duration `json:"flowLogsFlushInterval,omitempty" configv1timescale:"seconds"` // FlowLogsEnableHostEndpoint enables Flow logs reporting for HostEndpoints. FlowLogsEnableHostEndpoint *bool `json:"flowLogsEnableHostEndpoint,omitempty"` // FlowLogsEnableNetworkSets enables Flow logs reporting for GlobalNetworkSets. FlowLogsEnableNetworkSets *bool `json:"flowLogsEnableNetworkSets,omitempty"` // FlowLogsMaxOriginalIPsIncluded specifies the number of unique IP addresses (if relevant) that should be included in Flow logs. FlowLogsMaxOriginalIPsIncluded *int `json:"flowLogsMaxOriginalIPsIncluded,omitempty"` // FlowLogsCollectProcessInfo, if enabled Felix will load the kprobe BPF programs to collect process info. [Default: false] FlowLogsCollectProcessInfo *bool `json:"flowLogsCollectProcessInfo,omitempty" validate:"omitempty"` // FlowLogsCollectTcpStats enables flow logs reporting TCP socket stats FlowLogsCollectTcpStats *bool `json:"flowLogsCollectTcpStats,omitempty" validate:"omitempty"` // When FlowLogsCollectProcessPath and FlowLogsCollectProcessInfo are // both enabled, each flow log will include information about the process // that is sending or receiving the packets in that flow: the // `process_name` field will contain the full path of the process // executable, and the `process_args` field will have the arguments with // which the executable was invoked. Process information will not be // reported for connections which use raw sockets. FlowLogsCollectProcessPath *bool `json:"flowLogsCollectProcessPath,omitempty" validate:"omitempty"` // When FlowLogsCollectorDebugTrace is set to true, enables the logs in the collector to be // printed in their entirety. FlowLogsCollectorDebugTrace *bool `json:"flowLogsCollectorDebugTrace,omitempty"` // FlowLogsDestDomainsByClient is used to configure if the source IP is used in the mapping of top // level destination domains. [Default: true] FlowLogsDestDomainsByClient *bool `json:"flowLogsDestDomainsByClient,omitempty"` // FlowLogsFileEnabled when set to true, enables logging flow logs to a file. If false no flow logging to file will occur. FlowLogsFileEnabled *bool `json:"flowLogsFileEnabled,omitempty"` // FlowLogsFileMaxFiles sets the number of log files to keep. FlowLogsFileMaxFiles *int `json:"flowLogsFileMaxFiles,omitempty"` // FlowLogsFileMaxFileSizeMB sets the max size in MB of flow logs files before rotation. FlowLogsFileMaxFileSizeMB *int `json:"flowLogsFileMaxFileSizeMB,omitempty"` // FlowLogsFileDirectory sets the directory where flow logs files are stored. FlowLogsFileDirectory *string `json:"flowLogsFileDirectory,omitempty"` // FlowLogsFileIncludeLabels is used to configure if endpoint labels are included in a Flow log entry written to file. FlowLogsFileIncludeLabels *bool `json:"flowLogsFileIncludeLabels,omitempty"` // FlowLogsFileIncludePolicies is used to configure if policy information are included in a Flow log entry written to file. FlowLogsFileIncludePolicies *bool `json:"flowLogsFileIncludePolicies,omitempty"` // FlowLogsFileIncludeService is used to configure if the destination service is included in a Flow log entry written to file. // The service information can only be included if the flow was explicitly determined to be directed at the service (e.g. // when the pre-DNAT destination corresponds to the service ClusterIP and port). FlowLogsFileIncludeService *bool `json:"flowLogsFileIncludeService,omitempty"` // FlowLogsFileAggregationKindForAllowed is used to choose the type of aggregation for flow log entries created for // allowed connections. [Default: 2 - pod prefix name based aggregation]. // Accepted values are 0, 1 and 2. // 0 - No aggregation. // 1 - Source port based aggregation. // 2 - Pod prefix name based aggreagation. // +kubebuilder:validation:Enum=0;1;2 FlowLogsFileAggregationKindForAllowed *int `json:"flowLogsFileAggregationKindForAllowed,omitempty" validate:"omitempty,flowLogAggregationKind"` // FlowLogsFileAggregationKindForDenied is used to choose the type of aggregation for flow log entries created for // denied connections. [Default: 1 - source port based aggregation]. // Accepted values are 0, 1 and 2. // 0 - No aggregation. // 1 - Source port based aggregation. // 2 - Pod prefix name based aggregation. // 3 - No destination ports based aggregation. // +kubebuilder:validation:Enum=0;1;2;3 FlowLogsFileAggregationKindForDenied *int `json:"flowLogsFileAggregationKindForDenied,omitempty" validate:"omitempty,flowLogAggregationKind"` // FlowLogsFileEnabledForAllowed is used to enable/disable flow logs entries created for allowed connections. Default is true. // This parameter only takes effect when FlowLogsFileReporterEnabled is set to true. FlowLogsFileEnabledForAllowed *bool `json:"flowLogsFileEnabledForAllowed,omitempty"` // FlowLogsFileEnabledForDenied is used to enable/disable flow logs entries created for denied flows. Default is true. // This parameter only takes effect when FlowLogsFileReporterEnabled is set to true. FlowLogsFileEnabledForDenied *bool `json:"flowLogsFileEnabledForDenied,omitempty"` // FlowLogsDynamicAggregationEnabled is used to enable/disable dynamically changing aggregation levels. Default is true. FlowLogsDynamicAggregationEnabled *bool `json:"flowLogsDynamicAggregationEnabled,omitempty"` // FlowLogsPositionFilePath is used specify the position of the external pipeline that reads flow logs. Default is /var/log/calico/flows.log.pos. // This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true. FlowLogsPositionFilePath *string `json:"flowLogsPositionFilePath,omitempty"` // FlowLogsAggregationThresholdBytes is used specify how far behind the external pipeline that reads flow logs can be. Default is 8192 bytes. // This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true. FlowLogsAggregationThresholdBytes *int `json:"flowLogsAggregationThresholdBytes,omitempty"` // FlowLogsFilePerFlowProcessLimit, is used to specify the maximum number of flow log entries with distinct process information // beyond which process information will be aggregated. [Default: 2] FlowLogsFilePerFlowProcessLimit *int `json:"flowLogsFilePerFlowProcessLimit,omitempty" validate:"omitempty"` // FlowLogsFilePerFlowProcessArgsLimit is used to specify the maximum number of distinct process args that will appear in the flowLogs. // Default value is 5 FlowLogsFilePerFlowProcessArgsLimit *int `json:"flowLogsFilePerFlowProcessArgsLimit,omitempty" validate:"omitempty"` // FlowLogsFileNatOutgoingPortLimit is used to specify the maximum number of distinct post SNAT ports that will appear // in the flowLogs. Default value is 3 FlowLogsFileNatOutgoingPortLimit *int `json:"flowLogsFileNatOutgoingPortLimit,omitempty" validate:"omitempty"` // FlowLogsFileDomainsLimit is used to configure the number of (destination) domains to include in the flow log. // These are not included for workload or host endpoint destinations. // [Default: 5] FlowLogsFileDomainsLimit *int `json:"flowLogsFileDomainsLimit,omitempty" validate:"omitempty"` // WindowsFlowLogsFileDirectory sets the directory where flow logs files are stored on Windows nodes. [Default: "c:\\TigeraCalico\\flowlogs"]. WindowsFlowLogsFileDirectory string `json:"windowsFlowLogsFileDirectory,omitempty"` // WindowsFlowLogsPositionFilePath is used to specify the position of the external pipeline that reads flow logs on Windows nodes. // [Default: "c:\\TigeraCalico\\flowlogs\\flows.log.pos"]. // This parameter only takes effect when FlowLogsDynamicAggregationEnabled is set to true. WindowsFlowLogsPositionFilePath string `json:"windowsFlowLogsPositionFilePath,omitempty"` // WindowsStatsDumpFilePath is used to specify the path of the stats dump file on Windows nodes. [Default: "c:\\TigeraCalico\\stats\\dump"] WindowsStatsDumpFilePath string `json:"windowsStatsDumpFilePath,omitempty"` // The name of the file that Felix uses to preserve learnt DNS information when restarting. [Default: // "c:\\TigeraCalico\\felix-dns-cache.txt"]. WindowsDNSCacheFile string `json:"windowsDnsCacheFile,omitempty"` // Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name // or IP's advertised TTL. The default value is 120s which is same as the default value of // ServicePointManager.DnsRefreshTimeout on .net framework. [Default: 120s]. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` WindowsDNSExtraTTL *metav1.Duration `json:"windowsDnsExtraTTL,omitempty" configv1timescale:"seconds"` // The DNS servers that Felix should trust. Each entry here must be `<ip>[:<port>]` - indicating an // explicit DNS server IP - or `k8s-service:[<namespace>/]<name>[:port]` - indicating a Kubernetes DNS // service. `<port>` defaults to the first service port, or 53 for an IP, and `<namespace>` to // `kube-system`. An IPv6 address with a port must use the square brackets convention, for example // `[fd00:83a6::12]:5353`.Note that Felix (calico-node) will need RBAC permission to read the details of // each service specified by a `k8s-service:...` form. [Default: "k8s-service:kube-dns"]. DNSTrustedServers *[]string `json:"dnsTrustedServers,omitempty" validate:"omitempty,dive,ipOrK8sService"` // The name of the file that Felix uses to preserve learnt DNS information when restarting. [Default: // "/var/run/calico/felix-dns-cache.txt"]. DNSCacheFile string `json:"dnsCacheFile,omitempty"` // The periodic interval at which Felix saves learnt DNS information to the cache file. [Default: // 60s]. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DNSCacheSaveInterval *metav1.Duration `json:"dnsCacheSaveInterval,omitempty" configv1timescale:"seconds"` // An arbitrary number that can be changed, at runtime, to tell Felix to discard all its // learnt DNS information. [Default: 0]. DNSCacheEpoch *int `json:"dnsCacheEpoch,omitempty"` // Extra time to keep IPs and alias names that are learnt from DNS, in addition to each name // or IP's advertised TTL. [Default: 0s]. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DNSExtraTTL *metav1.Duration `json:"dnsExtraTTL,omitempty" configv1timescale:"seconds"` // DNSLogsFlushInterval configures the interval at which Felix exports DNS logs. // [Default: 300s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DNSLogsFlushInterval *metav1.Duration `json:"dnsLogsFlushInterval,omitempty" configv1timescale:"seconds"` // DNSLogsFileEnabled controls logging DNS logs to a file. If false no DNS logging to file will occur. // [Default: false] DNSLogsFileEnabled *bool `json:"dnsLogsFileEnabled,omitempty"` // DNSLogsFileMaxFiles sets the number of DNS log files to keep. // [Default: 5] DNSLogsFileMaxFiles *int `json:"dnsLogsFileMaxFiles,omitempty"` // DNSLogsFileMaxFileSizeMB sets the max size in MB of DNS log files before rotation. // [Default: 100] DNSLogsFileMaxFileSizeMB *int `json:"dnsLogsFileMaxFileSizeMB,omitempty"` // DNSLogsFileDirectory sets the directory where DNS log files are stored. // [Default: /var/log/calico/dnslogs] DNSLogsFileDirectory *string `json:"dnsLogsFileDirectory,omitempty"` // DNSLogsFileIncludeLabels is used to configure if endpoint labels are included in a DNS log entry written to file. // [Default: true] DNSLogsFileIncludeLabels *bool `json:"dnsLogsFileIncludeLabels,omitempty"` // DNSLogsFileAggregationKind is used to choose the type of aggregation for DNS log entries. // [Default: 1 - client name prefix aggregation]. // Accepted values are 0 and 1. // 0 - No aggregation. // 1 - Aggregate over clients with the same name prefix. // +kubebuilder:validation:Enum=0;1 DNSLogsFileAggregationKind *int `json:"dnsLogsFileAggregationKind,omitempty" validate:"omitempty,dnsAggregationKind"` // Limit on the number of DNS logs that can be emitted within each flush interval. When // this limit has been reached, Felix counts the number of unloggable DNS responses within // the flush interval, and emits a WARNING log with that count at the same time as it // flushes the buffered DNS logs. [Default: 0, meaning no limit] DNSLogsFilePerNodeLimit *int `json:"dnsLogsFilePerNodeLimit,omitempty"` // DNSLogsLatency indicates to include measurements of DNS request/response latency in each DNS log. // [Default: true] DNSLogsLatency *bool `json:"dnsLogsLatency,omitempty"` // DNSPolicyMode specifies how DNS policy programming will be handled. // DelayDeniedPacket - Felix delays any denied packet that traversed a policy that included egress domain matches, // but did not match. The packet is released after a fixed time, or after the destination IP address was programmed. // DelayDNSResponse - Felix delays any DNS response until related IPSets are programmed. This introduces some // latency to all DNS packets (even when no IPSet programming is required), but it ensures policy hit statistics // are accurate. This is the recommended setting when you are making use of staged policies or policy rule hit // statistics. // NoDelay - Felix does not introduce any delay to the packets. DNS rules may not have been programmed by the time // the first packet traverses the policy rules. Client applications need to handle reconnection attempts if initial // connection attempts fail. This may be problematic for some applications or for very low DNS TTLs. // // On Windows, or when using the eBPF dataplane, this setting is ignored and "NoDelay" is always used. // // [Default: DelayDeniedPacket] DNSPolicyMode *DNSPolicyMode `json:"dnsPolicyMode,omitempty" validate:"omitempty,oneof=NoDelay DelayDeniedPacket DelayDNSResponse"` // DNSPolicyNfqueueID is the NFQUEUE ID to use for DNS Policy re-evaluation when the domains IP hasn't been programmed // to ipsets yet. Used when DNSPolicyMode is DelayDeniedPacket. [Default: 100] DNSPolicyNfqueueID *int `json:"dnsPolicyNfqueueID,omitempty" validate:"omitempty,gte=0,lte=65535"` // DNSPolicyNfqueueID is the size of the NFQUEUE for DNS policy re-evaluation. This is the maximum number of denied // packets that may be queued up pending re-evaluation. // Used when DNSPolicyMode is DelayDeniedPacket. [Default: 100] DNSPolicyNfqueueSize *int `json:"dnsPolicyNfqueueSize,omitempty" validate:"omitempty,gte=0,lte=65535"` // DNSPacketsNfqueueID is the NFQUEUE ID to use for capturing DNS packets to ensure programming IPSets occurs before // the response is released. Used when DNSPolicyMode is DelayDNSResponse. [Default: 101] DNSPacketsNfqueueID *int `json:"dnsPacketsNfqueueID,omitempty" validate:"omitempty,gte=0,lte=65535"` // DNSPacketsNfqueueSize is the size of the NFQUEUE for captured DNS packets. This is the maximum number of DNS // packets that may be queued awaiting programming in the dataplane. Used when DNSPolicyMode is DelayDNSResponse. // [Default: 100] DNSPacketsNfqueueSize *int `json:"dnsPacketsNfqueueSize,omitempty" validate:"omitempty,gte=0,lte=65535"` // DNSPacketsNfqueueMaxHoldDuration is the max length of time to hold on to a DNS response while waiting for the // the dataplane to be programmed. Used when DNSPolicyMode is DelayDNSResponse. // [Default: 3s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` DNSPacketsNfqueueMaxHoldDuration *metav1.Duration `json:"dnsPacketsNfqueueMaxHoldDuration,omitempty"` // L7LogsFlushInterval configures the interval at which Felix exports L7 logs. // [Default: 300s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` L7LogsFlushInterval *metav1.Duration `json:"l7LogsFlushInterval,omitempty" configv1timescale:"seconds"` // L7LogsFileEnabled controls logging L7 logs to a file. If false no L7 logging to file will occur. // [Default: true] L7LogsFileEnabled *bool `json:"l7LogsFileEnabled,omitempty"` // L7LogsFileMaxFiles sets the number of L7 log files to keep. // [Default: 5] L7LogsFileMaxFiles *int `json:"l7LogsFileMaxFiles,omitempty"` // L7LogsFileMaxFileSizeMB sets the max size in MB of L7 log files before rotation. // [Default: 100] L7LogsFileMaxFileSizeMB *int `json:"l7LogsFileMaxFileSizeMB,omitempty"` // L7LogsFileDirectory sets the directory where L7 log files are stored. // [Default: /var/log/calico/l7logs] L7LogsFileDirectory *string `json:"l7LogsFileDirectory,omitempty"` // L7LogsFileAggregationHTTPHeaderInfo is used to choose the type of aggregation for HTTP header data on L7 log entries. // [Default: ExcludeL7HTTPHeaderInfo - http header info removal]. // Accepted values are IncludeL7HTTPHeaderInfo and ExcludeL7HTTPHeaderInfo. // IncludeL7HTTPHeaderInfo - Include HTTP header data in the logs. // ExcludeL7HTTPHeaderInfo - Aggregate over all other fields ignoring the user agent and log type. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7HTTPHeaderInfo|ExcludeL7HTTPHeaderInfo)?$` L7LogsFileAggregationHTTPHeaderInfo *string `json:"l7LogsFileAggregationHTTPHeaderInfo,omitempty" validate:"omitempty,l7HTTPHeaderAggregation"` // L7LogsFileAggregationHTTPMethod is used to choose the type of aggregation for the HTTP request method on L7 log entries. // [Default: IncludeL7HTTPMethod - include the HTTP method]. // Accepted values are IncludeL7HTTPMethod and ExcludeL7HTTPMethod. // IncludeL7HTTPMethod - Include HTTP method in the logs. // ExcludeL7HTTPMethod - Aggregate over all other fields ignoring the HTTP method. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7HTTPMethod|ExcludeL7HTTPMethod)?$` L7LogsFileAggregationHTTPMethod *string `json:"l7LogsFileAggregationHTTPMethod,omitempty" validate:"omitempty,l7HTTPMethodAggregation"` // L7LogsFileAggregationServiceInfo is used to choose the type of aggregation for the service data on L7 log entries. // [Default: IncludeL7ServiceInfo - include service data]. // Accepted values are IncludeL7ServiceInfo and ExcludeL7ServiceInfo. // IncludeL7ServiceInfo - Include service data in the logs. // ExcludeL7ServiceInfo - Aggregate over all other fields ignoring the service name, namespace, and port. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7ServiceInfo|ExcludeL7ServiceInfo)?$` L7LogsFileAggregationServiceInfo *string `json:"l7LogsFileAggregationServiceInfo,omitempty" validate:"omitempty,l7ServiceAggregation"` // L7LogsFileAggregationDestinationInfo is used to choose the type of aggregation for the destination metadata on L7 log entries. // [Default: IncludeL7DestinationInfo - include destination metadata]. // Accepted values are IncludeL7DestinationInfo and ExcludeL7DestinationInfo. // IncludeL7DestinationInfo - Include destination metadata in the logs. // ExcludeL7DestinationInfo - Aggregate over all other fields ignoring the destination aggregated name, namespace, and type. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7DestinationInfo|ExcludeL7DestinationInfo)?$` L7LogsFileAggregationDestinationInfo *string `json:"l7LogsFileAggregationDestinationInfo,omitempty" validate:"omitempty,l7DestinationAggregation"` // L7LogsFileAggregationExcludeSourceInfo is used to choose the type of aggregation for the source metadata on L7 log entries. // [Default: IncludeL7SourceInfoNoPort - include all source metadata except for the source port]. // Accepted values are IncludeL7SourceInfo, IncludeL7SourceInfoNoPort, and ExcludeL7SourceInfo. // IncludeL7SourceInfo - Include source metadata in the logs. // IncludeL7SourceInfoNoPort - Include source metadata in the logs excluding the source port. // ExcludeL7SourceInfo - Aggregate over all other fields ignoring the source aggregated name, namespace, and type. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7SourceInfo|IncludeL7SourceInfoNoPort|ExcludeL7SourceInfo)?$` L7LogsFileAggregationSourceInfo *string `json:"l7LogsFileAggregationSourceInfo,omitempty" validate:"omitempty,l7SourceAggregation"` // L7LogsFileAggregationResponseCode is used to choose the type of aggregation for the response code on L7 log entries. // [Default: IncludeL7ResponseCode - include the response code]. // Accepted values are IncludeL7ResponseCode and ExcludeL7ResponseCode. // IncludeL7ResponseCode - Include the response code in the logs. // ExcludeL7ResponseCode - Aggregate over all other fields ignoring the response code. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7ResponseCode|ExcludeL7ResponseCode)?$` L7LogsFileAggregationResponseCode *string `json:"l7LogsFileAggregationResponseCode,omitempty" validate:"omitempty,l7ResponseCodeAggregation"` // L7LogsFileAggregationTrimURL is used to choose the type of aggregation for the url on L7 log entries. // [Default: IncludeL7FullURL - include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath]. // Accepted values: // IncludeL7FullURL - Include the full URL up to however many path components are allowed by L7LogsFileAggregationNumURLPath. // TrimURLQuery - Aggregate over all other fields ignoring the query parameters on the URL. // TrimURLQueryAndPath - Aggregate over all other fields and the base URL only. // ExcludeL7URL - Aggregate over all other fields ignoring the URL entirely. // +kubebuilder:validation:Pattern=`^(?i)(IncludeL7FullURL|TrimURLQuery|TrimURLQueryAndPath|ExcludeL7URL)?$` L7LogsFileAggregationTrimURL *string `json:"l7LogsFileAggregationTrimURL,omitempty" validate:"omitempty,l7URLAggregation"` // L7LogsFileAggregationNumURLPath is used to choose the number of components in the url path to display. // This allows for the url to be truncated in case parts of the path provide no value. Setting this value // to negative will allow all parts of the path to be displayed. // [Default: 5]. L7LogsFileAggregationNumURLPath *int `json:"l7LogsFileAggregationNumURLPath,omitempty"` // Limit on the length of the URL collected in L7 logs. When a URL length reaches this limit // it is sliced off, and the sliced URL is sent to log storage. [Default: 250] L7LogsFileAggregationURLCharLimit *int `json:"l7LogsFileAggregationURLCharLimit,omitempty"` // Limit on the number of L7 logs that can be emitted within each flush interval. When // this limit has been reached, Felix counts the number of unloggable L7 responses within // the flush interval, and emits a WARNING log with that count at the same time as it // flushes the buffered L7 logs. A value of 0 means no limit. [Default: 1500] L7LogsFilePerNodeLimit *int `json:"l7LogsFilePerNodeLimit,omitempty"` // WindowsNetworkName specifies which Windows HNS networks Felix should operate on. The default is to match // networks that start with "calico". Supports regular expression syntax. WindowsNetworkName *string `json:"windowsNetworkName,omitempty"` // RouteSource configures where Felix gets its routing information. // - WorkloadIPs: use workload endpoints to construct routes. // - CalicoIPAM: the default - use IPAM data to construct routes. // +kubebuilder:validation:Pattern=`^(?i)(WorkloadIPs|CalicoIPAM)?$` RouteSource string `json:"routeSource,omitempty" validate:"omitempty,routeSource"` // Calico programs additional Linux route tables for various purposes. // RouteTableRanges specifies a set of table index ranges that Calico should use. // Deprecates`RouteTableRange`, overrides `RouteTableRange`. RouteTableRanges *RouteTableRanges `json:"routeTableRanges,omitempty" validate:"omitempty,dive"` // Deprecated in favor of RouteTableRanges. // Calico programs additional Linux route tables for various purposes. // RouteTableRange specifies the indices of the route tables that Calico should use. RouteTableRange *RouteTableRange `json:"routeTableRange,omitempty" validate:"omitempty"` // EgressIPSupport defines three different support modes for egress IP function. [Default: Disabled] // - Disabled: Egress IP function is disabled. // - EnabledPerNamespace: Egress IP function is enabled and can be configured on a per-namespace basis; // per-pod egress annotations are ignored. // - EnabledPerNamespaceOrPerPod: Egress IP function is enabled and can be configured per-namespace or per-pod, // with per-pod egress annotations overriding namespace annotations. // +kubebuilder:validation:Pattern=`^(?i)(Disabled|EnabledPerNamespace|EnabledPerNamespaceOrPerPod)?$` EgressIPSupport string `json:"egressIPSupport,omitempty" validate:"omitempty,oneof=Disabled EnabledPerNamespace EnabledPerNamespaceOrPerPod"` // EgressIPVXLANPort is the port number of vxlan tunnel device for egress traffic. [Default: 4790] EgressIPVXLANPort *int `json:"egressIPVXLANPort,omitempty"` // EgressIPVXLANVNI is the VNI ID of vxlan tunnel device for egress traffic. [Default: 4097] EgressIPVXLANVNI *int `json:"egressIPVXLANVNI,omitempty"` // EgressIPRoutingRulePriority controls the priority value to use for the egress IP routing rule. [Default: 100] EgressIPRoutingRulePriority *int `json:"egressIPRoutingRulePriority,omitempty" validate:"omitempty,gt=0,lt=32766"` // EgressGatewayPollInterval is the interval at which Felix will poll remote egress gateways to check their // health. Only Egress Gateways with a named "health" port will be polled in this way. Egress Gateways that // fail the health check will be taken our of use as if they have been deleted. // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` EgressGatewayPollInterval *metav1.Duration `json:"egressGatewayPollInterval,omitempty" configv1timescale:"seconds"` // EgressGatewayPollFailureCount is the minimum number of poll failures before a remote Egress Gateway is considered // to have failed. EgressGatewayPollFailureCount *int `json:"egressGatewayPollFailureCount,omitempty" validate:"omitempty,gt=0"` // RouteSyncDisabled will disable all operations performed on the route table. Set to true to // run in network-policy mode only. RouteSyncDisabled *bool `json:"routeSyncDisabled,omitempty"` // ExternalNetworkSupport defines two different support modes for external network function. [Default: Disabled] // - Disabled: External network function is disabled. // - Enabled: External network function is enabled. // +kubebuilder:validation:Pattern=`^(?i)(Disabled|Enabled)?$` ExternalNetworkSupport string `json:"externalNetworkSupport,omitempty" validate:"omitempty,oneof=Disabled Enabled"` // ExternalNetworkRoutingRulePriority controls the priority value to use for the external network routing rule. [Default: 102] ExternalNetworkRoutingRulePriority *int `json:"externalNetworkRoutingRulePriority,omitempty" validate:"omitempty,gt=0,lt=32766"` // WireguardEnabled controls whether Wireguard is enabled for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network). [Default: false] WireguardEnabled *bool `json:"wireguardEnabled,omitempty"` // WireguardEnabledV6 controls whether Wireguard is enabled for IPv6 (encapsulating IPv6 traffic over an IPv6 underlay network). [Default: false] WireguardEnabledV6 *bool `json:"wireguardEnabledV6,omitempty"` // WireguardListeningPort controls the listening port used by IPv4 Wireguard. [Default: 51820] WireguardListeningPort *int `json:"wireguardListeningPort,omitempty" validate:"omitempty,gt=0,lte=65535"` // WireguardListeningPortV6 controls the listening port used by IPv6 Wireguard. [Default: 51821] WireguardListeningPortV6 *int `json:"wireguardListeningPortV6,omitempty" validate:"omitempty,gt=0,lte=65535"` // WireguardRoutingRulePriority controls the priority value to use for the Wireguard routing rule. [Default: 99] WireguardRoutingRulePriority *int `json:"wireguardRoutingRulePriority,omitempty" validate:"omitempty,gt=0,lt=32766"` // WireguardInterfaceName specifies the name to use for the IPv4 Wireguard interface. [Default: wireguard.cali] WireguardInterfaceName string `json:"wireguardInterfaceName,omitempty" validate:"omitempty,interface"` // WireguardInterfaceNameV6 specifies the name to use for the IPv6 Wireguard interface. [Default: wg-v6.cali] WireguardInterfaceNameV6 string `json:"wireguardInterfaceNameV6,omitempty" validate:"omitempty,interface"` // WireguardMTU controls the MTU on the IPv4 Wireguard interface. See Configuring MTU [Default: 1440] WireguardMTU *int `json:"wireguardMTU,omitempty"` // WireguardMTUV6 controls the MTU on the IPv6 Wireguard interface. See Configuring MTU [Default: 1420] WireguardMTUV6 *int `json:"wireguardMTUV6,omitempty"` // WireguardHostEncryptionEnabled controls whether Wireguard host-to-host encryption is enabled. [Default: false] WireguardHostEncryptionEnabled *bool `json:"wireguardHostEncryptionEnabled,omitempty"` // WireguardKeepAlive controls Wireguard PersistentKeepalive option. Set 0 to disable. [Default: 0] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` WireguardPersistentKeepAlive *metav1.Duration `json:"wireguardKeepAlive,omitempty"` // +kubebuilder:validation:MinLength=1 // CaptureDir controls directory to store file capture. [Default: /var/log/calico/pcap] CaptureDir *string `json:"captureDir,omitempty" validate:"omitempty,gt=0"` // +kubebuilder:validation:Minimum=1 // CaptureMaxSizeBytes controls the max size of a file capture. [Default: 10000000] CaptureMaxSizeBytes *int `json:"captureMaxSizeBytes,omitempty" validate:"omitempty,gt=0"` // +kubebuilder:validation:Minimum=1 // CaptureRotationSeconds controls the time rotation of a packet capture. [Default: 3600] CaptureRotationSeconds *int `json:"captureRotationSeconds,omitempty" validate:"omitempty,gt=0"` // +kubebuilder:validation:Minimum=1 // CaptureMaxFiles controls number of rotated capture file to keep. [Default: 2] CaptureMaxFiles *int `json:"captureMaxFiles,omitempty" validate:"omitempty,gt=0"` // Set source-destination-check on AWS EC2 instances. Accepted value must be one of "DoNothing", "Enable" or "Disable". // [Default: DoNothing] AWSSrcDstCheck *AWSSrcDstCheckOption `json:"awsSrcDstCheck,omitempty" validate:"omitempty,oneof=DoNothing Enable Disable"` // AWSSecondaryIPSupport controls whether Felix will try to provision AWS secondary ENIs for // workloads that have IPs from IP pools that are configured with an AWS subnet ID. If the field is set to // "EnabledENIPerWorkload" then each workload with an AWS-backed IP will be assigned its own secondary ENI. // If set to "Enabled" then each workload with an AWS-backed IP pool will be allocated a secondary IP address // on a secondary ENI; this mode requires additional IP pools to be provisioned for the host to claim IPs for // the primary IP of the secondary ENIs. Accepted value must be one of "Enabled", "EnabledENIPerWorkload" or // "Disabled". [Default: Disabled] // +kubebuilder:validation:Pattern=`^(?i)(Enabled|EnabledENIPerWorkload|Disabled)?$` AWSSecondaryIPSupport string `json:"awsSecondaryIPSupport,omitempty" validate:"omitempty,oneof=Enabled EnabledENIPerWorkload Disabled"` // AWSSecondaryIPRoutingRulePriority controls the priority that Felix will use for routing rules when programming // them for AWS Secondary IP support. [Default: 101] AWSSecondaryIPRoutingRulePriority *int `json:"awsSecondaryIPRoutingRulePriority,omitempty" validate:"omitempty,gte=0,lte=4294967295"` // AWSRequestTimeout is the timeout on AWS API requests. [Default: 30s] // +kubebuilder:validation:Type=string // +kubebuilder:validation:Pattern=`^([0-9]+(\\.[0-9]+)?(ms|s|m|h))*$` AWSRequestTimeout *metav1.Duration `json:"awsRequestTimeout,omitempty" configv1timescale:"seconds"` // When service IP advertisement is enabled, prevent routing loops to service IPs that are // not in use, by dropping or rejecting packets that do not get DNAT'd by kube-proxy. // Unless set to "Disabled", in which case such routing loops continue to be allowed. // [Default: Drop] // +kubebuilder:validation:Pattern=`^(?i)(Drop|Reject|Disabled)?$` ServiceLoopPrevention string `json:"serviceLoopPrevention,omitempty" validate:"omitempty,oneof=Drop Reject Disabled"` // WorkloadSourceSpoofing controls whether pods can use the allowedSourcePrefixes annotation to send traffic with a source IP // address that is not theirs. This is disabled by default. When set to "Any", pods can request any prefix. // +kubebuilder:validation:Pattern=`^(?i)(Disabled|Any)?$` WorkloadSourceSpoofing string `json:"workloadSourceSpoofing,omitempty" validate:"omitempty,oneof=Disabled Any"` // MTUIfacePattern is a regular expression that controls which interfaces Felix should scan in order // to calculate the host's MTU. // This should not match workload interfaces (usually named cali...). // +optional MTUIfacePattern string `json:"mtuIfacePattern,omitempty" validate:"omitempty,regexp"` // TPROXYMode sets whether traffic is directed through a transparent proxy // for further processing or not and how is the proxying done. // [Default: Disabled] // +kubebuilder:validation:Pattern=`^(?i)(Disabled|Enabled|EnabledAllServices)?$` TPROXYMode string `json:"tproxyMode,omitempty" validate:"omitempty,oneof=Disabled Enabled EnabledAllServices"` // TPROXYPort sets to which port proxied traffic should be redirected. // [Default: 16001] TPROXYPort *int `json:"tproxyPort,omitempty" validate:"omitempty,gt=0,lte=65535"` // TPROXYUpstreamConnMark tells Felix which mark is used by the proxy for its upstream // connections so that Felix can program the dataplane correctly. [Default: 0x17] TPROXYUpstreamConnMark *uint32 `json:"tproxyUpstreamConnMark,omitempty" validate:"omitempty,gt=0"` // FloatingIPs configures whether or not Felix will program non-OpenStack floating IP addresses. (OpenStack-derived // floating IPs are always programmed, regardless of this setting.) // // +optional FloatingIPs *FloatingIPType `json:"floatingIPs,omitempty" validate:"omitempty"` // WindowsManageFirewallRules configures whether or not Felix will program Windows Firewall rules. (to allow inbound access to its own metrics ports) [Default: Disabled] // +optional WindowsManageFirewallRules *WindowsManageFirewallRulesMode `json:"windowsManageFirewallRules,omitempty" validate:"omitempty,oneof=Enabled Disabled"` }
FelixConfigurationSpec contains the values of the Felix configuration.
func (*FelixConfigurationSpec) DeepCopy ¶
func (in *FelixConfigurationSpec) DeepCopy() *FelixConfigurationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FelixConfigurationSpec.
func (*FelixConfigurationSpec) DeepCopyInto ¶
func (in *FelixConfigurationSpec) DeepCopyInto(out *FelixConfigurationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type FloatingIPType ¶
type FloatingIPType string
+kubebuilder:validation:Enum=Enabled;Disabled
const ( FloatingIPsEnabled FloatingIPType = "Enabled" FloatingIPsDisabled FloatingIPType = "Disabled" )
type FlowEndpoint ¶
type FlowEndpoint struct { // The endpoint type, indicating whether this is a Pod, HostEndpoint, NetworkSet, or internet. Kind string `json:"kind"` // The name of the endpoint. Note that this name may actually be a name prefix if flow logs have // been aggregated. Name string `json:"name"` // Whether the name is an aggregation prefix rather than the actual name. NameIsAggregationPrefix bool `json:"nameIsAggregationPrefix,omitempty"` // The namespace of the endpoint. Namespace string `json:"namespace,omitempty"` }
func (*FlowEndpoint) DeepCopy ¶
func (in *FlowEndpoint) DeepCopy() *FlowEndpoint
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FlowEndpoint.
func (*FlowEndpoint) DeepCopyInto ¶
func (in *FlowEndpoint) DeepCopyInto(out *FlowEndpoint)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (FlowEndpoint) String ¶
func (f FlowEndpoint) String() string
Prints FlowEndpoint contents. This is a slightly less verbose version of the resource names but should have sufficient context to be useful.
type GatewayPreferenceType ¶
type GatewayPreferenceType string
+kubebuilder:validation:Enum=None;PreferNodeLocal
const ( GatewayPreferenceNone GatewayPreferenceType = "None" GatewayPreferenceNodeLocal GatewayPreferenceType = "PreferNodeLocal" )
type GlobalAlert ¶
type GlobalAlert struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the GlobalAlert. Spec GlobalAlertSpec `json:"spec,omitempty"` Status GlobalAlertStatus `json:"status,omitempty"` }
func NewGlobalAlert ¶
func NewGlobalAlert() *GlobalAlert
NewGlobalAlert creates a new (zeroed) GlobalAlert struct with the TypeMetadata initialized to the current version.
func (*GlobalAlert) DeepCopy ¶
func (in *GlobalAlert) DeepCopy() *GlobalAlert
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlert.
func (*GlobalAlert) DeepCopyInto ¶
func (in *GlobalAlert) DeepCopyInto(out *GlobalAlert)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalAlert) DeepCopyObject ¶
func (in *GlobalAlert) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalAlertList ¶
type GlobalAlertList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []GlobalAlert `json:"items"` }
GlobalAlertList contains a list of GlobalAlert resources.
func NewGlobalAlertList ¶
func NewGlobalAlertList() *GlobalAlertList
NewGlobalAlertList creates a new (zeroed) GlobalAlertList struct with the TypeMetadata initialized to the current version.
func (*GlobalAlertList) DeepCopy ¶
func (in *GlobalAlertList) DeepCopy() *GlobalAlertList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertList.
func (*GlobalAlertList) DeepCopyInto ¶
func (in *GlobalAlertList) DeepCopyInto(out *GlobalAlertList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalAlertList) DeepCopyObject ¶
func (in *GlobalAlertList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalAlertSpec ¶
type GlobalAlertSpec struct { // Type will dictate how the fields of the GlobalAlert will be utilized. // Each Type will have different usages and defaults for the fields. [Default: RuleBased] Type GlobalAlertType `json:"type,omitempty" validate:"omitempty,globalAlertType"` // Template for the description field in generated events, description is used if this is omitted. Summary string `json:"summary,omitempty" validate:"omitempty"` // Human-readable description of the template. Description string `json:"description" validate:"required"` // Severity of the alert for display in Manager. Severity int `json:"severity" validate:"required,min=1,max=100"` // If Type is RuleBased, it is how often the query defined will run. // If Type is AnomalyDetection it is how often the detector will be run. Period *metav1.Duration `json:"period,omitempty" validate:"omitempty"` // How much data to gather at once. // If Type is RuleBased, it must exceed audit log flush interval, dnsLogsFlushInterval, or flowLogsFlushInterval as appropriate. Lookback *metav1.Duration `json:"lookback,omitempty" validate:"omitempty"` // DataSet determines which dataset type the Query will use. // Required and used only if Type is RuleBased. DataSet string `json:"dataSet,omitempty" validate:"omitempty,oneof=flows dns audit l7 waf vulnerability"` // Which data to include from the source data set. Written in a domain-specific query language. Only used if Type is RuleBased. Query string `json:"query,omitempty" validate:"omitempty"` // An optional list of fields to aggregate results. // Only used if Type is RuleBased. AggregateBy []string `json:"aggregateBy,omitempty" validate:"omitempty"` // Which field to aggregate results by if using a metric other than count. // Only used if Type is RuleBased. Field string `json:"field,omitempty" validate:"omitempty"` // A metric to apply to aggregated results. count is the number of log entries matching the aggregation pattern. // Others are applied only to numeric fields in the logs. // Only used if Type is RuleBased. Metric string `json:"metric,omitempty" validate:"omitempty,oneof=avg max min sum count"` // Compare the value of the metric to the threshold using this condition. // Only used if Type is RuleBased. Condition string `json:"condition,omitempty" validate:"omitempty,oneof=eq not_eq gt gte lt lte"` // A numeric value to compare the value of the metric against. // Only used if Type is RuleBased. Threshold float64 `json:"threshold,omitempty" validate:"omitempty"` // An optional list of values to replace variable names in query. // Only used if Type is RuleBased. Substitutions []GlobalAlertSubstitution `json:"substitutions,omitempty" validate:"omitempty"` // Parameters for configuring an AnomalyDetection run. // Only used if Type is AnomalyDetection. Detector *DetectorParams `json:"detector,omitempty" validate:"omitempty"` }
func (*GlobalAlertSpec) DeepCopy ¶
func (in *GlobalAlertSpec) DeepCopy() *GlobalAlertSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertSpec.
func (*GlobalAlertSpec) DeepCopyInto ¶
func (in *GlobalAlertSpec) DeepCopyInto(out *GlobalAlertSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalAlertStatus ¶
type GlobalAlertStatus struct { LastUpdate *metav1.Time `json:"lastUpdate,omitempty"` Active bool `json:"active"` Healthy bool `json:"healthy"` LastExecuted *metav1.Time `json:"lastExecuted,omitempty"` LastEvent *metav1.Time `json:"lastEvent,omitempty"` ErrorConditions []ErrorCondition `json:"errorConditions,omitempty"` }
func (*GlobalAlertStatus) DeepCopy ¶
func (in *GlobalAlertStatus) DeepCopy() *GlobalAlertStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertStatus.
func (*GlobalAlertStatus) DeepCopyInto ¶
func (in *GlobalAlertStatus) DeepCopyInto(out *GlobalAlertStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalAlertSubstitution ¶
type GlobalAlertSubstitution struct { Name string `json:"name" validate:"required"` Values []string `json:"values,omitempty"` }
GlobalAlertSubstitution substitutes for the variables in the set operators of a Query.
func (*GlobalAlertSubstitution) DeepCopy ¶
func (in *GlobalAlertSubstitution) DeepCopy() *GlobalAlertSubstitution
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertSubstitution.
func (*GlobalAlertSubstitution) DeepCopyInto ¶
func (in *GlobalAlertSubstitution) DeepCopyInto(out *GlobalAlertSubstitution)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalAlertTemplate ¶
type GlobalAlertTemplate struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the GlobalAlert. Spec GlobalAlertSpec `json:"spec,omitempty"` }
func NewGlobalAlertTemplate ¶
func NewGlobalAlertTemplate() *GlobalAlertTemplate
NewGlobalAlert creates a new (zeroed) GlobalAlert struct with the TypeMetadata initialized to the current version.
func (*GlobalAlertTemplate) DeepCopy ¶
func (in *GlobalAlertTemplate) DeepCopy() *GlobalAlertTemplate
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertTemplate.
func (*GlobalAlertTemplate) DeepCopyInto ¶
func (in *GlobalAlertTemplate) DeepCopyInto(out *GlobalAlertTemplate)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalAlertTemplate) DeepCopyObject ¶
func (in *GlobalAlertTemplate) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalAlertTemplateList ¶
type GlobalAlertTemplateList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []GlobalAlertTemplate `json:"items"` }
GlobalAlertList contains a list of GlobalAlert resources.
func NewGlobalAlertTemplateList ¶
func NewGlobalAlertTemplateList() *GlobalAlertTemplateList
NewGlobalAlertTemplateList creates a new (zeroed) GlobalAlertTemplateList struct with the TypeMetadata initialized to the current version.
func (*GlobalAlertTemplateList) DeepCopy ¶
func (in *GlobalAlertTemplateList) DeepCopy() *GlobalAlertTemplateList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalAlertTemplateList.
func (*GlobalAlertTemplateList) DeepCopyInto ¶
func (in *GlobalAlertTemplateList) DeepCopyInto(out *GlobalAlertTemplateList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalAlertTemplateList) DeepCopyObject ¶
func (in *GlobalAlertTemplateList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalAlertType ¶
type GlobalAlertType string
const ( GlobalAlertTypeRuleBased GlobalAlertType = "RuleBased" GlobalAlertTypeAnomalyDetection GlobalAlertType = "AnomalyDetection" )
func (*GlobalAlertType) UnmarshalJSON ¶
func (t *GlobalAlertType) UnmarshalJSON(b []byte) error
type GlobalNetworkPolicy ¶
type GlobalNetworkPolicy struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec GlobalNetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewGlobalNetworkPolicy ¶
func NewGlobalNetworkPolicy() *GlobalNetworkPolicy
NewGlobalNetworkPolicy creates a new (zeroed) GlobalNetworkPolicy struct with the TypeMetadata initialised to the current version.
func (*GlobalNetworkPolicy) DeepCopy ¶
func (in *GlobalNetworkPolicy) DeepCopy() *GlobalNetworkPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkPolicy.
func (*GlobalNetworkPolicy) DeepCopyInto ¶
func (in *GlobalNetworkPolicy) DeepCopyInto(out *GlobalNetworkPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalNetworkPolicy) DeepCopyObject ¶
func (in *GlobalNetworkPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalNetworkPolicyList ¶
type GlobalNetworkPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []GlobalNetworkPolicy `json:"items" protobuf:"bytes,2,rep,name=items"` }
GlobalNetworkPolicyList is a list of Policy objects.
func (*GlobalNetworkPolicyList) DeepCopy ¶
func (in *GlobalNetworkPolicyList) DeepCopy() *GlobalNetworkPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkPolicyList.
func (*GlobalNetworkPolicyList) DeepCopyInto ¶
func (in *GlobalNetworkPolicyList) DeepCopyInto(out *GlobalNetworkPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalNetworkPolicyList) DeepCopyObject ¶
func (in *GlobalNetworkPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalNetworkPolicySpec ¶
type GlobalNetworkPolicySpec struct { // The name of the tier that this policy belongs to. If this is omitted, the default // tier (name is "default") is assumed. The specified tier must exist in order to create // security policies within the tier, the "default" tier is created automatically if it // does not exist, this means for deployments requiring only a single Tier, the tier name // may be omitted on all policy management requests. Tier string `json:"tier,omitempty" validate:"omitempty,name"` // Order is an optional field that specifies the order in which the policy is applied. // Policies with higher "order" are applied after those with lower // order within the same tier. If the order is omitted, it may be considered to be "infinite" - i.e. the // policy will be applied last. Policies with identical order will be applied in // alphanumerical order based on the Policy "Name" within the tier. Order *float64 `json:"order,omitempty"` // The ordered set of ingress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"` // The ordered set of egress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"` // The selector is an expression used to pick out the endpoints that the policy should // be applied to. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() or the empty selector -> matches all endpoints. // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) Selector string `json:"selector,omitempty" validate:"selector"` // Types indicates whether this policy applies to ingress, or to egress, or to both. When // not explicitly specified (and so the value on creation is empty or nil), Calico defaults // Types according to what Ingress and Egress rules are present in the policy. The // default is: // // - [ PolicyTypeIngress ], if there are no Egress rules (including the case where there are // also no Ingress rules) // // - [ PolicyTypeEgress ], if there are Egress rules but no Ingress rules // // - [ PolicyTypeIngress, PolicyTypeEgress ], if there are both Ingress and Egress rules. // // When the policy is read back again, Types will always be one of these values, never empty // or nil. Types []PolicyType `json:"types,omitempty" validate:"omitempty,dive,policyType"` // DoNotTrack indicates whether packets matched by the rules in this policy should go through // the data plane's connection tracking, such as Linux conntrack. If True, the rules in // this policy are applied before any data plane connection tracking, and packets allowed by // this policy are marked as not to be tracked. DoNotTrack bool `json:"doNotTrack,omitempty"` // PreDNAT indicates to apply the rules in this policy before any DNAT. PreDNAT bool `json:"preDNAT,omitempty"` // ApplyOnForward indicates to apply the rules in this policy on forward traffic. ApplyOnForward bool `json:"applyOnForward,omitempty"` // ServiceAccountSelector is an optional field for an expression used to select a pod based on service accounts. ServiceAccountSelector string `json:"serviceAccountSelector,omitempty" validate:"selector"` // NamespaceSelector is an optional field for an expression used to select a pod based on namespaces. NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"selector"` // PerformanceHints contains a list of hints to Calico's policy engine to // help process the policy more efficiently. Hints never change the // enforcement behaviour of the policy. // // Currently, the only available hint is "AssumeNeededOnEveryNode". When // that hint is set on a policy, Felix will act as if the policy matches // a local endpoint even if it does not. This is useful for "preloading" // any large static policies that are known to be used on every node. // If the policy is _not_ used on a particular node then the work // done to preload the policy (and to maintain it) is wasted. PerformanceHints []PolicyPerformanceHint `json:"performanceHints,omitempty" validate:"omitempty,unique,dive,oneof=AssumeNeededOnEveryNode"` }
func (*GlobalNetworkPolicySpec) DeepCopy ¶
func (in *GlobalNetworkPolicySpec) DeepCopy() *GlobalNetworkPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkPolicySpec.
func (*GlobalNetworkPolicySpec) DeepCopyInto ¶
func (in *GlobalNetworkPolicySpec) DeepCopyInto(out *GlobalNetworkPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalNetworkSet ¶
type GlobalNetworkSet struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec GlobalNetworkSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs and domain names that share labels to allow rules to refer to them via selectors. The labels of GlobalNetworkSet are not namespaced.
func NewGlobalNetworkSet ¶
func NewGlobalNetworkSet() *GlobalNetworkSet
NewGlobalNetworkSet creates a new (zeroed) NetworkSet struct with the TypeMetadata initialised to the current version.
func (*GlobalNetworkSet) DeepCopy ¶
func (in *GlobalNetworkSet) DeepCopy() *GlobalNetworkSet
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkSet.
func (*GlobalNetworkSet) DeepCopyInto ¶
func (in *GlobalNetworkSet) DeepCopyInto(out *GlobalNetworkSet)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalNetworkSet) DeepCopyObject ¶
func (in *GlobalNetworkSet) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalNetworkSetList ¶
type GlobalNetworkSetList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []GlobalNetworkSet `json:"items" protobuf:"bytes,2,rep,name=items"` }
GlobalNetworkSetList is a list of NetworkSet objects.
func (*GlobalNetworkSetList) DeepCopy ¶
func (in *GlobalNetworkSetList) DeepCopy() *GlobalNetworkSetList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkSetList.
func (*GlobalNetworkSetList) DeepCopyInto ¶
func (in *GlobalNetworkSetList) DeepCopyInto(out *GlobalNetworkSetList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalNetworkSetList) DeepCopyObject ¶
func (in *GlobalNetworkSetList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalNetworkSetSpec ¶
type GlobalNetworkSetSpec struct { // The list of IP networks that belong to this set. Nets []string `json:"nets,omitempty" validate:"omitempty,dive,cidr"` // The list of domain names that belong to this set and are honored in egress allow rules // only. Domain names specified here only work to allow egress traffic from the cluster to // external destinations. They don't work to _deny_ traffic to destinations specified by // domain name, or to allow ingress traffic from _sources_ specified by domain name. AllowedEgressDomains []string `json:"allowedEgressDomains,omitempty" validate:"omitempty,dive,wildname"` }
GlobalNetworkSetSpec contains the specification for a NetworkSet resource.
func (*GlobalNetworkSetSpec) DeepCopy ¶
func (in *GlobalNetworkSetSpec) DeepCopy() *GlobalNetworkSetSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkSetSpec.
func (*GlobalNetworkSetSpec) DeepCopyInto ¶
func (in *GlobalNetworkSetSpec) DeepCopyInto(out *GlobalNetworkSetSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalNetworkSetSync ¶
type GlobalNetworkSetSync struct {
Labels map[string]string `json:"labels,omitempty" validate:"labels"`
}
func (*GlobalNetworkSetSync) DeepCopy ¶
func (in *GlobalNetworkSetSync) DeepCopy() *GlobalNetworkSetSync
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalNetworkSetSync.
func (*GlobalNetworkSetSync) DeepCopyInto ¶
func (in *GlobalNetworkSetSync) DeepCopyInto(out *GlobalNetworkSetSync)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalReport ¶
type GlobalReport struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the GlobalReport. Spec ReportSpec `json:"spec,omitempty"` Status ReportStatus `json:"status,omitempty"` }
GlobalReport contains the configuration for a non-namespaced Report.
func NewGlobalReport ¶
func NewGlobalReport() *GlobalReport
NewGlobalReport creates a new (zeroed) GlobalReport struct with the TypeMetadata initialized to the current version.
func (*GlobalReport) DeepCopy ¶
func (in *GlobalReport) DeepCopy() *GlobalReport
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalReport.
func (*GlobalReport) DeepCopyInto ¶
func (in *GlobalReport) DeepCopyInto(out *GlobalReport)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalReport) DeepCopyObject ¶
func (in *GlobalReport) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalReportList ¶
type GlobalReportList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []GlobalReport `json:"items"` }
GlobalReportList contains a list of GlobalReport resources.
func NewGlobalReportList ¶
func NewGlobalReportList() *GlobalReportList
NewGlobalReportList creates a new (zeroed) GlobalReportList struct with the TypeMetadata initialized to the current version.
func (*GlobalReportList) DeepCopy ¶
func (in *GlobalReportList) DeepCopy() *GlobalReportList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalReportList.
func (*GlobalReportList) DeepCopyInto ¶
func (in *GlobalReportList) DeepCopyInto(out *GlobalReportList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalReportList) DeepCopyObject ¶
func (in *GlobalReportList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalReportType ¶
type GlobalReportType struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the GlobalReport. Spec ReportTypeSpec `json:"spec,omitempty"` }
GlobalReportType contains the configuration for a non-namespaced report type.
func NewGlobalReportType ¶
func NewGlobalReportType() *GlobalReportType
New GlobalReportType creates a new (zeroed) GlobalReportype struct with the TypeMetadata initialized to the current version.
func (*GlobalReportType) DeepCopy ¶
func (in *GlobalReportType) DeepCopy() *GlobalReportType
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalReportType.
func (*GlobalReportType) DeepCopyInto ¶
func (in *GlobalReportType) DeepCopyInto(out *GlobalReportType)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalReportType) DeepCopyObject ¶
func (in *GlobalReportType) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalReportTypeList ¶
type GlobalReportTypeList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []GlobalReportType `json:"items"` }
GlobalReportTypeList contains a list of GlobalReportType resources.
func NewGlobalReportTypeList ¶
func NewGlobalReportTypeList() *GlobalReportTypeList
NewGlobalReportTypeList creates a new (zeroed) GlobalReportTypeList struct with the TypeMetadata initialized to the current version.
func (*GlobalReportTypeList) DeepCopy ¶
func (in *GlobalReportTypeList) DeepCopy() *GlobalReportTypeList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalReportTypeList.
func (*GlobalReportTypeList) DeepCopyInto ¶
func (in *GlobalReportTypeList) DeepCopyInto(out *GlobalReportTypeList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalReportTypeList) DeepCopyObject ¶
func (in *GlobalReportTypeList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalThreatFeed ¶
type GlobalThreatFeed struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the GlobalThreatFeed. Spec GlobalThreatFeedSpec `json:"spec,omitempty"` Status GlobalThreatFeedStatus `json:"status,omitempty"` }
GlobalThreatFeed is a source of intel for possible threats to the cluster. This object configures how Tigera components communicate with the feed and update detection jobs or policy based on the intel. +kubebuilder:subresource:status
func NewGlobalThreatFeed ¶
func NewGlobalThreatFeed() *GlobalThreatFeed
NewGlobalThreatFeed creates a new (zeroed) GlobalThreatFeed struct with the TypeMetadata initialised to the current version.
func (*GlobalThreatFeed) DeepCopy ¶
func (in *GlobalThreatFeed) DeepCopy() *GlobalThreatFeed
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalThreatFeed.
func (*GlobalThreatFeed) DeepCopyInto ¶
func (in *GlobalThreatFeed) DeepCopyInto(out *GlobalThreatFeed)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalThreatFeed) DeepCopyObject ¶
func (in *GlobalThreatFeed) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalThreatFeedList ¶
type GlobalThreatFeedList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []GlobalThreatFeed `json:"items"` }
GlobalThreatFeedList contains a list of GlobalThreatFeed resources.
func NewGlobalThreatFeedList ¶
func NewGlobalThreatFeedList() *GlobalThreatFeedList
NewGlobalThreatFeedList creates a new (zeroed) GlobalThreatFeedList struct with the TypeMetadata initialised to the current version.
func (*GlobalThreatFeedList) DeepCopy ¶
func (in *GlobalThreatFeedList) DeepCopy() *GlobalThreatFeedList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalThreatFeedList.
func (*GlobalThreatFeedList) DeepCopyInto ¶
func (in *GlobalThreatFeedList) DeepCopyInto(out *GlobalThreatFeedList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*GlobalThreatFeedList) DeepCopyObject ¶
func (in *GlobalThreatFeedList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type GlobalThreatFeedSpec ¶
type GlobalThreatFeedSpec struct { // Content describes the kind of data the data feed provides. // +kubebuilder:default=IPSet // +optional Content ThreatFeedContent `json:"content,omitempty" validate:"omitempty,oneof=IPSet DomainNameSet"` // Determines whether the Global Threat Feed is Enabled or Disabled. // +kubebuilder:default=Enabled // +optional Mode *ThreatFeedMode `json:"mode,omitempty" validate:"omitempty,oneof=Enabled Disabled"` // Human-readable description of the template. // +kubebuilder:validation:MaxLength:=256 Description string `json:"description,omitempty"` // Distinguishes between Builtin Global Threat Feeds and Custom feed types. // +kubebuilder:default=Custom // +optional FeedType *ThreatFeedType `json:"feedType,omitempty" validate:"omitempty,oneof=Builtin Custom"` GlobalNetworkSet *GlobalNetworkSetSync `json:"globalNetworkSet,omitempty"` Pull *Pull `json:"pull,omitempty"` }
GlobalThreatFeedSpec contains the specification of a GlobalThreatFeed resource.
func (*GlobalThreatFeedSpec) DeepCopy ¶
func (in *GlobalThreatFeedSpec) DeepCopy() *GlobalThreatFeedSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalThreatFeedSpec.
func (*GlobalThreatFeedSpec) DeepCopyInto ¶
func (in *GlobalThreatFeedSpec) DeepCopyInto(out *GlobalThreatFeedSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type GlobalThreatFeedStatus ¶
type GlobalThreatFeedStatus struct { // +optional LastSuccessfulSync *metav1.Time `json:"lastSuccessfulSync,omitempty"` // +optional LastSuccessfulSearch *metav1.Time `json:"lastSuccessfulSearch,omitempty"` // +optional ErrorConditions []ErrorCondition `json:"errorConditions,omitempty"` }
func (*GlobalThreatFeedStatus) DeepCopy ¶
func (in *GlobalThreatFeedStatus) DeepCopy() *GlobalThreatFeedStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalThreatFeedStatus.
func (*GlobalThreatFeedStatus) DeepCopyInto ¶
func (in *GlobalThreatFeedStatus) DeepCopyInto(out *GlobalThreatFeedStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HTTPHeader ¶
type HTTPHeader struct { Name string `json:"name" validate:"printascii"` Value string `json:"value,omitempty"` ValueFrom *HTTPHeaderSource `json:"valueFrom,omitempty"` }
func (*HTTPHeader) DeepCopy ¶
func (in *HTTPHeader) DeepCopy() *HTTPHeader
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPHeader.
func (*HTTPHeader) DeepCopyInto ¶
func (in *HTTPHeader) DeepCopyInto(out *HTTPHeader)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HTTPHeaderSource ¶
type HTTPHeaderSource struct { // Selects a key of a ConfigMap. // +optional ConfigMapKeyRef *k8sv1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty"` // Selects a key of a secret in the pod's namespace // +optional SecretKeyRef *k8sv1.SecretKeySelector `json:"secretKeyRef,omitempty"` }
func (*HTTPHeaderSource) DeepCopy ¶
func (in *HTTPHeaderSource) DeepCopy() *HTTPHeaderSource
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPHeaderSource.
func (*HTTPHeaderSource) DeepCopyInto ¶
func (in *HTTPHeaderSource) DeepCopyInto(out *HTTPHeaderSource)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HTTPMatch ¶
type HTTPMatch struct { // Methods is an optional field that restricts the rule to apply only to HTTP requests that use one of the listed // HTTP Methods (e.g. GET, PUT, etc.) // Multiple methods are OR'd together. Methods []string `json:"methods,omitempty" validate:"omitempty"` // Paths is an optional field that restricts the rule to apply to HTTP requests that use one of the listed // HTTP Paths. // Multiple paths are OR'd together. // e.g: // - exact: /foo // - prefix: /bar // NOTE: Each entry may ONLY specify either a `exact` or a `prefix` match. The validator will check for it. Paths []HTTPPath `json:"paths,omitempty" validate:"omitempty"` }
HTTPMatch is an optional field that apply only to HTTP requests The Methods and Path fields are joined with AND
func (*HTTPMatch) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPMatch.
func (*HTTPMatch) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HTTPPath ¶
type HTTPPath struct { Exact string `json:"exact,omitempty" validate:"omitempty"` Prefix string `json:"prefix,omitempty" validate:"omitempty"` }
HTTPPath specifies an HTTP path to match. It may be either of the form: exact: <path>: which matches the path exactly or prefix: <path-prefix>: which matches the path prefix
func (*HTTPPath) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPPath.
func (*HTTPPath) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HTTPPull ¶
type HTTPPull struct { Format ThreatFeedFormat `json:"format,omitempty" validate:"omitempty"` URL string `json:"url" validate:"required,url"` Headers []HTTPHeader `json:"headers,omitempty" validate:"dive"` }
func (*HTTPPull) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPPull.
func (*HTTPPull) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HealthTimeoutOverride ¶
type HealthTimeoutOverride struct { Name string `json:"name"` Timeout metav1.Duration `json:"timeout"` }
func (*HealthTimeoutOverride) DeepCopy ¶
func (in *HealthTimeoutOverride) DeepCopy() *HealthTimeoutOverride
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthTimeoutOverride.
func (*HealthTimeoutOverride) DeepCopyInto ¶
func (in *HealthTimeoutOverride) DeepCopyInto(out *HealthTimeoutOverride)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type HostEndpoint ¶
type HostEndpoint struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec HostEndpointSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewHostEndpoint ¶
func NewHostEndpoint() *HostEndpoint
NewHostEndpoint creates a new (zeroed) HostEndpoint struct with the TypeMetadata initialised to the current version.
func (*HostEndpoint) DeepCopy ¶
func (in *HostEndpoint) DeepCopy() *HostEndpoint
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostEndpoint.
func (*HostEndpoint) DeepCopyInto ¶
func (in *HostEndpoint) DeepCopyInto(out *HostEndpoint)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*HostEndpoint) DeepCopyObject ¶
func (in *HostEndpoint) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type HostEndpointList ¶
type HostEndpointList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []HostEndpoint `json:"items" protobuf:"bytes,2,rep,name=items"` }
HostEndpointList is a list of HostEndpoint objects.
func (*HostEndpointList) DeepCopy ¶
func (in *HostEndpointList) DeepCopy() *HostEndpointList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostEndpointList.
func (*HostEndpointList) DeepCopyInto ¶
func (in *HostEndpointList) DeepCopyInto(out *HostEndpointList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*HostEndpointList) DeepCopyObject ¶
func (in *HostEndpointList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type HostEndpointSpec ¶
type HostEndpointSpec struct { // The node name identifying the Calico node instance. Node string `json:"node,omitempty" validate:"omitempty,name"` // Either "*", or the name of a specific Linux interface to apply policy to; or empty. "*" // indicates that this HostEndpoint governs all traffic to, from or through the default // network namespace of the host named by the "Node" field; entering and leaving that // namespace via any interface, including those from/to non-host-networked local workloads. // // If InterfaceName is not "*", this HostEndpoint only governs traffic that enters or leaves // the host through the specific interface named by InterfaceName, or - when InterfaceName // is empty - through the specific interface that has one of the IPs in ExpectedIPs. // Therefore, when InterfaceName is empty, at least one expected IP must be specified. Only // external interfaces (such as "eth0") are supported here; it isn't possible for a // HostEndpoint to protect traffic through a specific local workload interface. // // Note: Only some kinds of policy are implemented for "*" HostEndpoints; initially just // pre-DNAT policy. Please check Calico documentation for the latest position. InterfaceName string `json:"interfaceName,omitempty" validate:"omitempty,interface"` // The expected IP addresses (IPv4 and IPv6) of the endpoint. // If "InterfaceName" is not present, Calico will look for an interface matching any // of the IPs in the list and apply policy to that. // Note: // When using the selector match criteria in an ingress or egress security Policy // or Profile, Calico converts the selector into a set of IP addresses. For host // endpoints, the ExpectedIPs field is used for that purpose. (If only the interface // name is specified, Calico does not learn the IPs of the interface for use in match // criteria.) ExpectedIPs []string `json:"expectedIPs,omitempty" validate:"omitempty,dive,ip"` // A list of identifiers of security Profile objects that apply to this endpoint. Each // profile is applied in the order that they appear in this list. Profile rules are applied // after the selector-based security policy. Profiles []string `json:"profiles,omitempty" validate:"omitempty,dive,name"` // Ports contains the endpoint's named ports, which may be referenced in security policy rules. Ports []EndpointPort `json:"ports,omitempty" validate:"dive"` }
HostEndpointSpec contains the specification for a HostEndpoint resource.
func (*HostEndpointSpec) DeepCopy ¶
func (in *HostEndpointSpec) DeepCopy() *HostEndpointSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostEndpointSpec.
func (*HostEndpointSpec) DeepCopyInto ¶
func (in *HostEndpointSpec) DeepCopyInto(out *HostEndpointSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ICMPFields ¶
type ICMPFields struct { // Match on a specific ICMP type. For example a value of 8 refers to ICMP Echo Request // (i.e. pings). Type *int `json:"type,omitempty" validate:"omitempty,gte=0,lte=254"` // Match on a specific ICMP code. If specified, the Type value must also be specified. // This is a technical limitation imposed by the kernel's iptables firewall, which // Calico uses to enforce the rule. Code *int `json:"code,omitempty" validate:"omitempty,gte=0,lte=255"` }
ICMPFields defines structure for ICMP and NotICMP sub-struct for ICMP code and type
func (*ICMPFields) DeepCopy ¶
func (in *ICMPFields) DeepCopy() *ICMPFields
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ICMPFields.
func (*ICMPFields) DeepCopyInto ¶
func (in *ICMPFields) DeepCopyInto(out *ICMPFields)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IPAMConfiguration ¶
type IPAMConfiguration struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec IPAMConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
IPAMConfiguration contains information about a block for IP address assignment.
func NewIPAMConfiguration ¶
func NewIPAMConfiguration() *IPAMConfiguration
NewIPAMConfiguration creates a new (zeroed) IPAMConfiguration struct with the TypeMetadata initialised to the current version.
func (*IPAMConfiguration) DeepCopy ¶
func (in *IPAMConfiguration) DeepCopy() *IPAMConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAMConfiguration.
func (*IPAMConfiguration) DeepCopyInto ¶
func (in *IPAMConfiguration) DeepCopyInto(out *IPAMConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPAMConfiguration) DeepCopyObject ¶
func (in *IPAMConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPAMConfigurationList ¶
type IPAMConfigurationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []IPAMConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` }
IPAMConfigurationList contains a list of IPAMConfiguration resources.
func (*IPAMConfigurationList) DeepCopy ¶
func (in *IPAMConfigurationList) DeepCopy() *IPAMConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAMConfigurationList.
func (*IPAMConfigurationList) DeepCopyInto ¶
func (in *IPAMConfigurationList) DeepCopyInto(out *IPAMConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPAMConfigurationList) DeepCopyObject ¶
func (in *IPAMConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPAMConfigurationSpec ¶
type IPAMConfigurationSpec struct { // When StrictAffinity is true, borrowing IP addresses is not allowed. StrictAffinity bool `json:"strictAffinity" validate:"required"` // MaxBlocksPerHost, if non-zero, is the max number of blocks that can be // affine to each host. MaxBlocksPerHost int32 `json:"maxBlocksPerHost,omitempty"` }
IPAMConfigurationSpec contains the specification for an IPPool resource.
func (*IPAMConfigurationSpec) DeepCopy ¶
func (in *IPAMConfigurationSpec) DeepCopy() *IPAMConfigurationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAMConfigurationSpec.
func (*IPAMConfigurationSpec) DeepCopyInto ¶
func (in *IPAMConfigurationSpec) DeepCopyInto(out *IPAMConfigurationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IPIPConfiguration ¶
type IPIPConfiguration struct { // When enabled is true, ipip tunneling will be used to deliver packets to // destinations within this pool. Enabled bool `json:"enabled,omitempty"` // The IPIP mode. This can be one of "always" or "cross-subnet". A mode // of "always" will also use IPIP tunneling for routing to destination IP // addresses within this pool. A mode of "cross-subnet" will only use IPIP // tunneling when the destination node is on a different subnet to the // originating node. The default value (if not specified) is "always". Mode EncapMode `json:"mode,omitempty" validate:"ipIpMode"` }
func (*IPIPConfiguration) DeepCopy ¶
func (in *IPIPConfiguration) DeepCopy() *IPIPConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPIPConfiguration.
func (*IPIPConfiguration) DeepCopyInto ¶
func (in *IPIPConfiguration) DeepCopyInto(out *IPIPConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IPPool ¶
type IPPool struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec IPPoolSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewIPPool ¶
func NewIPPool() *IPPool
NewIPPool creates a new (zeroed) IPPool struct with the TypeMetadata initialised to the current version.
func (*IPPool) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPPool.
func (*IPPool) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPPool) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPPoolAllowedUse ¶
type IPPoolAllowedUse string
const ( IPPoolAllowedUseWorkload IPPoolAllowedUse = "Workload" IPPoolAllowedUseTunnel IPPoolAllowedUse = "Tunnel" IPPoolAllowedUseHostSecondary IPPoolAllowedUse = "HostSecondaryInterface" )
type IPPoolList ¶
type IPPoolList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []IPPool `json:"items" protobuf:"bytes,2,rep,name=items"` }
IPPoolList contains a list of IPPool resources.
func (*IPPoolList) DeepCopy ¶
func (in *IPPoolList) DeepCopy() *IPPoolList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPPoolList.
func (*IPPoolList) DeepCopyInto ¶
func (in *IPPoolList) DeepCopyInto(out *IPPoolList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPPoolList) DeepCopyObject ¶
func (in *IPPoolList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPPoolSpec ¶
type IPPoolSpec struct { // The pool CIDR. CIDR string `json:"cidr" validate:"net"` // Contains configuration for VXLAN tunneling for this pool. If not specified, // then this is defaulted to "Never" (i.e. VXLAN tunneling is disabled). VXLANMode VXLANMode `json:"vxlanMode,omitempty" validate:"omitempty,vxlanMode"` // Contains configuration for IPIP tunneling for this pool. If not specified, // then this is defaulted to "Never" (i.e. IPIP tunneling is disabled). IPIPMode IPIPMode `json:"ipipMode,omitempty" validate:"omitempty,ipIpMode"` // When natOutgoing is true, packets sent from Calico networked containers in // this pool to destinations outside of this pool will be masqueraded. NATOutgoing bool `json:"natOutgoing,omitempty"` // When disabled is true, Calico IPAM will not assign addresses from this pool. Disabled bool `json:"disabled,omitempty"` // Disable exporting routes from this IP Pool's CIDR over BGP. [Default: false] DisableBGPExport bool `json:"disableBGPExport,omitempty" validate:"omitempty"` // The block size to use for IP address assignments from this pool. Defaults to 26 for IPv4 and 122 for IPv6. BlockSize int `json:"blockSize,omitempty"` // Allows IPPool to allocate for a specific node by label selector. NodeSelector string `json:"nodeSelector,omitempty" validate:"omitempty,selector"` // Deprecated: this field is only used for APIv1 backwards compatibility. // Setting this field is not allowed, this field is for internal use only. IPIP *IPIPConfiguration `json:"ipip,omitempty" validate:"omitempty,mustBeNil"` // Deprecated: this field is only used for APIv1 backwards compatibility. // Setting this field is not allowed, this field is for internal use only. NATOutgoingV1 bool `json:"nat-outgoing,omitempty" validate:"omitempty,mustBeFalse"` // AllowedUse controls what the IP pool will be used for. If not specified or empty, defaults to // ["Tunnel", "Workload"] for back-compatibility AllowedUses []IPPoolAllowedUse `json:"allowedUses,omitempty" validate:"omitempty"` // AWSSubnetID if specified Calico will attempt to ensure that IPs chosen from this IP pool are routed // to the corresponding node by adding one or more secondary ENIs to the node and explicitly assigning // the IP to one of the secondary ENIs. Important: since subnets cannot cross availability zones, // it's important to use Kubernetes node selectors to avoid scheduling pods to one availability zone // using an IP pool that is backed by a subnet that belongs to another availability zone. If AWSSubnetID // is specified, then the CIDR of the IP pool must be contained within the specified AWS subnet. AWSSubnetID string `json:"awsSubnetID,omitempty" validate:"omitempty"` }
IPPoolSpec contains the specification for an IPPool resource.
func (*IPPoolSpec) DeepCopy ¶
func (in *IPPoolSpec) DeepCopy() *IPPoolSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPPoolSpec.
func (*IPPoolSpec) DeepCopyInto ¶
func (in *IPPoolSpec) DeepCopyInto(out *IPPoolSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IPReservation ¶
type IPReservation struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec IPReservationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
IPReservation allows certain IP addresses to be reserved (i.e. prevented from being allocated) by Calico IPAM. Reservations only block new allocations, they do not cause existing IP allocations to be released. The current implementation is only suitable for reserving small numbers of IP addresses relative to the size of the IP pool. If large portions of an IP pool are reserved, Calico IPAM may hunt for a long time to find a non-reserved IP.
func NewIPReservation ¶
func NewIPReservation() *IPReservation
NewIPReservation creates a new (zeroed) IPReservation struct with the TypeMetadata initialised to the current version.
func (*IPReservation) DeepCopy ¶
func (in *IPReservation) DeepCopy() *IPReservation
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPReservation.
func (*IPReservation) DeepCopyInto ¶
func (in *IPReservation) DeepCopyInto(out *IPReservation)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPReservation) DeepCopyObject ¶
func (in *IPReservation) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPReservationList ¶
type IPReservationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []IPReservation `json:"items" protobuf:"bytes,2,rep,name=items"` }
IPReservationList contains a list of IPReservation resources.
func (*IPReservationList) DeepCopy ¶
func (in *IPReservationList) DeepCopy() *IPReservationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPReservationList.
func (*IPReservationList) DeepCopyInto ¶
func (in *IPReservationList) DeepCopyInto(out *IPReservationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*IPReservationList) DeepCopyObject ¶
func (in *IPReservationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type IPReservationSpec ¶
type IPReservationSpec struct { // ReservedCIDRs is a list of CIDRs and/or IP addresses that Calico IPAM will exclude from new allocations. ReservedCIDRs []string `json:"reservedCIDRs,omitempty" validate:"cidrs,omitempty"` }
IPReservationSpec contains the specification for an IPReservation resource.
func (*IPReservationSpec) DeepCopy ¶
func (in *IPReservationSpec) DeepCopy() *IPReservationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPReservationSpec.
func (*IPReservationSpec) DeepCopyInto ¶
func (in *IPReservationSpec) DeepCopyInto(out *IPReservationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type IptablesBackend ¶
type IptablesBackend string
type KubeConfig ¶
type KubeConfig struct { // When using the Kubernetes datastore, the location of a kubeconfig file. Valid if DatastoreType is kubernetes. Kubeconfig string `json:"kubeconfig,omitempty" validate:"omitempty,file"` // Location of the Kubernetes API. Not required if using kubeconfig. Valid if DatastoreType is kubernetes. K8sAPIEndpoint string `json:"k8sAPIEndpoint,omitempty" validate:"omitempty,k8sEndpoint"` // Location of a client key for accessing the Kubernetes API. Valid if DatastoreType is kubernetes. K8sKeyFile string `json:"k8sKeyFile,omitempty" validate:"omitempty,file"` // Location of a client certificate for accessing the Kubernetes API. Valid if DatastoreType is kubernetes. K8sCertFile string `json:"k8sCertFile,omitempty" validate:"omitempty,file"` // Location of a CA for accessing the Kubernetes API. Valid if DatastoreType is kubernetes. K8sCAFile string `json:"k8sCAFile,omitempty" validate:"omitempty,file"` // Token to be used for accessing the Kubernetes API. Valid if DatastoreType is kubernetes. K8sAPIToken string `json:"k8sAPIToken,omitempty" validate:"omitempty"` K8sInsecureSkipTLSVerify bool `json:"k8sInsecureSkipTLSVerify,omitempty" validate:"omitempty"` // This is an alternative to Kubeconfig and if specified overrides Kubeconfig. // This contains the contents that would normally be in the file pointed at by Kubeconfig. KubeconfigInline string `json:"kubeconfigInline,omitempty" ignored:"true"` }
func (*KubeConfig) DeepCopy ¶
func (in *KubeConfig) DeepCopy() *KubeConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeConfig.
func (*KubeConfig) DeepCopyInto ¶
func (in *KubeConfig) DeepCopyInto(out *KubeConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type KubeControllersConfiguration ¶
type KubeControllersConfiguration struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec KubeControllersConfigurationSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` Status KubeControllersConfigurationStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"` }
func NewKubeControllersConfiguration ¶
func NewKubeControllersConfiguration() *KubeControllersConfiguration
New KubeControllersConfiguration creates a new (zeroed) KubeControllersConfiguration struct with the TypeMetadata initialized to the current version.
func (*KubeControllersConfiguration) DeepCopy ¶
func (in *KubeControllersConfiguration) DeepCopy() *KubeControllersConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeControllersConfiguration.
func (*KubeControllersConfiguration) DeepCopyInto ¶
func (in *KubeControllersConfiguration) DeepCopyInto(out *KubeControllersConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*KubeControllersConfiguration) DeepCopyObject ¶
func (in *KubeControllersConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type KubeControllersConfigurationList ¶
type KubeControllersConfigurationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []KubeControllersConfiguration `json:"items" protobuf:"bytes,2,rep,name=items"` }
KubeControllersConfigurationList contains a list of KubeControllersConfiguration object.
func (*KubeControllersConfigurationList) DeepCopy ¶
func (in *KubeControllersConfigurationList) DeepCopy() *KubeControllersConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeControllersConfigurationList.
func (*KubeControllersConfigurationList) DeepCopyInto ¶
func (in *KubeControllersConfigurationList) DeepCopyInto(out *KubeControllersConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*KubeControllersConfigurationList) DeepCopyObject ¶
func (in *KubeControllersConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type KubeControllersConfigurationSpec ¶
type KubeControllersConfigurationSpec struct { // LogSeverityScreen is the log severity above which logs are sent to the stdout. [Default: Info] LogSeverityScreen string `json:"logSeverityScreen,omitempty" validate:"omitempty,logLevel"` // HealthChecks enables or disables support for health checks [Default: Enabled] HealthChecks string `json:"healthChecks,omitempty" validate:"omitempty,oneof=Enabled Disabled"` // EtcdV3CompactionPeriod is the period between etcdv3 compaction requests. Set to 0 to disable. [Default: 10m] EtcdV3CompactionPeriod *metav1.Duration `json:"etcdV3CompactionPeriod,omitempty" validate:"omitempty"` // PrometheusMetricsPort is the TCP port that the Prometheus metrics server should bind to. Set to 0 to disable. [Default: 9094] PrometheusMetricsPort *int `json:"prometheusMetricsPort,omitempty"` // Controllers enables and configures individual Kubernetes controllers Controllers ControllersConfig `json:"controllers"` // DebugProfilePort configures the port to serve memory and cpu profiles on. If not specified, profiling // is disabled. DebugProfilePort *int32 `json:"debugProfilePort,omitempty"` }
KubeControllersConfigurationSpec contains the values of the Kubernetes controllers configuration.
func (*KubeControllersConfigurationSpec) DeepCopy ¶
func (in *KubeControllersConfigurationSpec) DeepCopy() *KubeControllersConfigurationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeControllersConfigurationSpec.
func (*KubeControllersConfigurationSpec) DeepCopyInto ¶
func (in *KubeControllersConfigurationSpec) DeepCopyInto(out *KubeControllersConfigurationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type KubeControllersConfigurationStatus ¶
type KubeControllersConfigurationStatus struct { // RunningConfig contains the effective config that is running in the kube-controllers pod, after // merging the API resource with any environment variables. RunningConfig KubeControllersConfigurationSpec `json:"runningConfig,omitempty"` // EnvironmentVars contains the environment variables on the kube-controllers that influenced // the RunningConfig. EnvironmentVars map[string]string `json:"environmentVars,omitempty"` }
KubeControllersConfigurationStatus represents the status of the configuration. It's useful for admins to be able to see the actual config that was applied, which can be modified by environment variables on the kube-controllers process.
func (*KubeControllersConfigurationStatus) DeepCopy ¶
func (in *KubeControllersConfigurationStatus) DeepCopy() *KubeControllersConfigurationStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubeControllersConfigurationStatus.
func (*KubeControllersConfigurationStatus) DeepCopyInto ¶
func (in *KubeControllersConfigurationStatus) DeepCopyInto(out *KubeControllersConfigurationStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type LicenseKey ¶
type LicenseKey struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. This resource is a singleton, always named "default". metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the LicenseKey. Spec LicenseKeySpec `json:"spec,omitempty"` // Status of the LicenseKey. Status LicenseKeyStatus `json:"status,omitempty"` }
LicenseKey contains the Tigera CNX license key for the cluster.
func NewLicenseKey ¶
func NewLicenseKey() *LicenseKey
New LicenseKey creates a new (zeroed) LicenseKey struct with the TypeMetadata initialized to the current version.
func (*LicenseKey) DeepCopy ¶
func (in *LicenseKey) DeepCopy() *LicenseKey
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LicenseKey.
func (*LicenseKey) DeepCopyInto ¶
func (in *LicenseKey) DeepCopyInto(out *LicenseKey)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*LicenseKey) DeepCopyObject ¶
func (in *LicenseKey) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type LicenseKeyList ¶
type LicenseKeyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []LicenseKey `json:"items"` }
LicenseKeyList contains a list of LicenseKey resources (even though there should only be one).
func NewLicenseKeyList ¶
func NewLicenseKeyList() *LicenseKeyList
NewLicenseKeyList creates a new (zeroed) LicenseKeyList struct with the TypeMetadata initialized to the current version.
func (*LicenseKeyList) DeepCopy ¶
func (in *LicenseKeyList) DeepCopy() *LicenseKeyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LicenseKeyList.
func (*LicenseKeyList) DeepCopyInto ¶
func (in *LicenseKeyList) DeepCopyInto(out *LicenseKeyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*LicenseKeyList) DeepCopyObject ¶
func (in *LicenseKeyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type LicenseKeySpec ¶
type LicenseKeySpec struct { // Token is the JWT containing the license claims Token string `json:"token" yaml:"token"` // Certificate is used to validate the token. Certificate string `json:"certificate,omitempty" yaml:"certificate" validate:"omitempty"` }
LicenseKeySpec contains the license key itself.
func (*LicenseKeySpec) DeepCopy ¶
func (in *LicenseKeySpec) DeepCopy() *LicenseKeySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LicenseKeySpec.
func (*LicenseKeySpec) DeepCopyInto ¶
func (in *LicenseKeySpec) DeepCopyInto(out *LicenseKeySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type LicenseKeyStatus ¶
type LicenseKeyStatus struct { // Expiry is the expiry date of License // +nullable Expiry metav1.Time `json:"expiry,omitempty" yaml:"expiry"` // Maximum Number of Allowed Nodes MaxNodes int `json:"maxnodes,omitempty" yaml:"maxnodes" validate:"omitempty"` // License package defines type of Calico license that is being enforced Package LicensePackageType `json:"package,omitempty" yaml:"package" validate:"omitempty"` // List of features that are available via the applied license Features []string `json:"features,omitempty" yaml:"features" validate:"omitempty"` }
LicenseKeyStatus contains the license key information.
func (*LicenseKeyStatus) DeepCopy ¶
func (in *LicenseKeyStatus) DeepCopy() *LicenseKeyStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LicenseKeyStatus.
func (*LicenseKeyStatus) DeepCopyInto ¶
func (in *LicenseKeyStatus) DeepCopyInto(out *LicenseKeyStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type LicensePackageType ¶
type LicensePackageType string
+kubebuilder:validation:Enum=CloudCommunity;CloudStarter;CloudPro;Enterprise
const ( CloudCommunity LicensePackageType = "CloudCommunity" CloudStarter LicensePackageType = "CloudStarter" CloudPro LicensePackageType = "CloudPro" Enterprise LicensePackageType = "Enterprise" )
type ManagedCluster ¶
type ManagedCluster struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the ManagedCluster. Spec ManagedClusterSpec `json:"spec,omitempty"` // Status of the ManagedCluster Status ManagedClusterStatus `json:"status,omitempty"` }
ManagedCluster represents a cluster that is being managed by the multi-cluster management plane. This object configures how Tigera multi-cluster management components communicate with the corresponding cluster.
func NewManagedCluster ¶
func NewManagedCluster() *ManagedCluster
NewManagedCluster creates a new (zeroed) ManagedCluster struct with the TypeMetadata initialised to the current version.
func (*ManagedCluster) DeepCopy ¶
func (in *ManagedCluster) DeepCopy() *ManagedCluster
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedCluster.
func (*ManagedCluster) DeepCopyInto ¶
func (in *ManagedCluster) DeepCopyInto(out *ManagedCluster)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ManagedCluster) DeepCopyObject ¶
func (in *ManagedCluster) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ManagedClusterList ¶
type ManagedClusterList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []ManagedCluster `json:"items"` }
ManagedClusterList contains a list of ManagedCluster resources.
func NewManagedClusterList ¶
func NewManagedClusterList() *ManagedClusterList
NewManagedClusterList creates a new (zeroed) ManagedClusterList struct with the TypeMetadata initialised to the current version.
func (*ManagedClusterList) DeepCopy ¶
func (in *ManagedClusterList) DeepCopy() *ManagedClusterList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterList.
func (*ManagedClusterList) DeepCopyInto ¶
func (in *ManagedClusterList) DeepCopyInto(out *ManagedClusterList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ManagedClusterList) DeepCopyObject ¶
func (in *ManagedClusterList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ManagedClusterSpec ¶
type ManagedClusterSpec struct { // Field to store dynamically generated manifest for installing component into // the actual application cluster corresponding to this Managed Cluster InstallationManifest string `json:"installationManifest,omitempty"` // The namespace of the managed cluster's operator. This value is used in // the generation of the InstallationManifest. OperatorNamespace string `json:"operatorNamespace,omitempty"` // The certificate used to authenticate the managed cluster to the management cluster. Certificate []byte `json:"certificate,omitempty"` }
ManagedClusterSpec contains the specification of a ManagedCluster resource.
func (*ManagedClusterSpec) DeepCopy ¶
func (in *ManagedClusterSpec) DeepCopy() *ManagedClusterSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterSpec.
func (*ManagedClusterSpec) DeepCopyInto ¶
func (in *ManagedClusterSpec) DeepCopyInto(out *ManagedClusterSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ManagedClusterStatus ¶
type ManagedClusterStatus struct {
Conditions []ManagedClusterStatusCondition `json:"conditions,omitempty"`
}
func (*ManagedClusterStatus) DeepCopy ¶
func (in *ManagedClusterStatus) DeepCopy() *ManagedClusterStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterStatus.
func (*ManagedClusterStatus) DeepCopyInto ¶
func (in *ManagedClusterStatus) DeepCopyInto(out *ManagedClusterStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ManagedClusterStatusCondition ¶
type ManagedClusterStatusCondition struct { Message string `json:"message,omitempty"` Reason string `json:"reason,omitempty"` Status ManagedClusterStatusValue `json:"status"` Type ManagedClusterStatusType `json:"type"` }
Condition contains various status information
func (*ManagedClusterStatusCondition) DeepCopy ¶
func (in *ManagedClusterStatusCondition) DeepCopy() *ManagedClusterStatusCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedClusterStatusCondition.
func (*ManagedClusterStatusCondition) DeepCopyInto ¶
func (in *ManagedClusterStatusCondition) DeepCopyInto(out *ManagedClusterStatusCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ManagedClusterStatusType ¶
type ManagedClusterStatusType string
type ManagedClusterStatusValue ¶
type ManagedClusterStatusValue string
type NamedSelector ¶
type NamedSelector struct { Name string `json:"name" validate:"uiDescription"` Selector string `json:"selector" validate:"selector"` }
A Calico format label selector with an associated name.
func (*NamedSelector) DeepCopy ¶
func (in *NamedSelector) DeepCopy() *NamedSelector
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamedSelector.
func (*NamedSelector) DeepCopyInto ¶
func (in *NamedSelector) DeepCopyInto(out *NamedSelector)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamesAndLabelsMatch ¶
type NamesAndLabelsMatch struct { // Names is an optional field that specifies a set of resources by name. Names []string `json:"names,omitempty" validate:"omitempty"` // Selector is an optional field that selects a set of resources by label. // If both Names and Selector are specified then they are AND'ed. Selector string `json:"selector,omitempty" validate:"omitempty,selector"` }
NamesAndLabelsMatch is used to specify resource matches using both label and name selection.
func (*NamesAndLabelsMatch) DeepCopy ¶
func (in *NamesAndLabelsMatch) DeepCopy() *NamesAndLabelsMatch
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamesAndLabelsMatch.
func (*NamesAndLabelsMatch) DeepCopyInto ¶
func (in *NamesAndLabelsMatch) DeepCopyInto(out *NamesAndLabelsMatch)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NamespaceControllerConfig ¶
type NamespaceControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation with the Calico datastore. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` }
NamespaceControllerConfig configures the service account controller, which syncs Kubernetes service accounts to Calico profiles (only used for etcdv3 datastore).
func (*NamespaceControllerConfig) DeepCopy ¶
func (in *NamespaceControllerConfig) DeepCopy() *NamespaceControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceControllerConfig.
func (*NamespaceControllerConfig) DeepCopyInto ¶
func (in *NamespaceControllerConfig) DeepCopyInto(out *NamespaceControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NetworkPolicy ¶
type NetworkPolicy struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec NetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewNetworkPolicy ¶
func NewNetworkPolicy() *NetworkPolicy
NewNetworkPolicy creates a new (zeroed) NetworkPolicy struct with the TypeMetadata initialised to the current version.
func (*NetworkPolicy) DeepCopy ¶
func (in *NetworkPolicy) DeepCopy() *NetworkPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkPolicy.
func (*NetworkPolicy) DeepCopyInto ¶
func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*NetworkPolicy) DeepCopyObject ¶
func (in *NetworkPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type NetworkPolicyList ¶
type NetworkPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []NetworkPolicy `json:"items" protobuf:"bytes,2,rep,name=items"` }
NetworkPolicyList is a list of Policy objects.
func (*NetworkPolicyList) DeepCopy ¶
func (in *NetworkPolicyList) DeepCopy() *NetworkPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkPolicyList.
func (*NetworkPolicyList) DeepCopyInto ¶
func (in *NetworkPolicyList) DeepCopyInto(out *NetworkPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*NetworkPolicyList) DeepCopyObject ¶
func (in *NetworkPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type NetworkPolicySpec ¶
type NetworkPolicySpec struct { // The name of the tier that this policy belongs to. If this is omitted, the default // tier (name is "default") is assumed. The specified tier must exist in order to create // security policies within the tier, the "default" tier is created automatically if it // does not exist, this means for deployments requiring only a single Tier, the tier name // may be omitted on all policy management requests. Tier string `json:"tier,omitempty" validate:"omitempty,name"` // Order is an optional field that specifies the order in which the policy is applied. // Policies with higher "order" are applied after those with lower // order within the same tier. If the order is omitted, it may be considered to be "infinite" - i.e. the // policy will be applied last. Policies with identical order will be applied in // alphanumerical order based on the Policy "Name" within the tier. Order *float64 `json:"order,omitempty"` // The ordered set of ingress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"` // The ordered set of egress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"` // The selector is an expression used to pick out the endpoints that the policy should // be applied to. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() or the empty selector -> matches all endpoints. // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) Selector string `json:"selector,omitempty" validate:"selector"` // Types indicates whether this policy applies to ingress, or to egress, or to both. When // not explicitly specified (and so the value on creation is empty or nil), Calico defaults // Types according to what Ingress and Egress are present in the policy. The // default is: // // - [ PolicyTypeIngress ], if there are no Egress rules (including the case where there are // also no Ingress rules) // // - [ PolicyTypeEgress ], if there are Egress rules but no Ingress rules // // - [ PolicyTypeIngress, PolicyTypeEgress ], if there are both Ingress and Egress rules. // // When the policy is read back again, Types will always be one of these values, never empty // or nil. Types []PolicyType `json:"types,omitempty" validate:"omitempty,dive,policyType"` // ServiceAccountSelector is an optional field for an expression used to select a pod based on service accounts. ServiceAccountSelector string `json:"serviceAccountSelector,omitempty" validate:"selector"` // PerformanceHints contains a list of hints to Calico's policy engine to // help process the policy more efficiently. Hints never change the // enforcement behaviour of the policy. // // Currently, the only available hint is "AssumeNeededOnEveryNode". When // that hint is set on a policy, Felix will act as if the policy matches // a local endpoint even if it does not. This is useful for "preloading" // any large static policies that are known to be used on every node. // If the policy is _not_ used on a particular node then the work // done to preload the policy (and to maintain it) is wasted. PerformanceHints []PolicyPerformanceHint `json:"performanceHints,omitempty" validate:"omitempty,unique,dive,oneof=AssumeNeededOnEveryNode"` }
func (*NetworkPolicySpec) DeepCopy ¶
func (in *NetworkPolicySpec) DeepCopy() *NetworkPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkPolicySpec.
func (*NetworkPolicySpec) DeepCopyInto ¶
func (in *NetworkPolicySpec) DeepCopyInto(out *NetworkPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NetworkSet ¶
type NetworkSet struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec NetworkSetSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewNetworkSet ¶
func NewNetworkSet() *NetworkSet
NewNetworkSet creates a new (zeroed) NetworkSet struct with the TypeMetadata initialised to the current version.
func (*NetworkSet) DeepCopy ¶
func (in *NetworkSet) DeepCopy() *NetworkSet
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkSet.
func (*NetworkSet) DeepCopyInto ¶
func (in *NetworkSet) DeepCopyInto(out *NetworkSet)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*NetworkSet) DeepCopyObject ¶
func (in *NetworkSet) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type NetworkSetList ¶
type NetworkSetList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []NetworkSet `json:"items" protobuf:"bytes,2,rep,name=items"` }
NetworkSetList is a list of NetworkSet objects.
func (*NetworkSetList) DeepCopy ¶
func (in *NetworkSetList) DeepCopy() *NetworkSetList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkSetList.
func (*NetworkSetList) DeepCopyInto ¶
func (in *NetworkSetList) DeepCopyInto(out *NetworkSetList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*NetworkSetList) DeepCopyObject ¶
func (in *NetworkSetList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type NetworkSetSpec ¶
type NetworkSetSpec struct { // The list of IP networks that belong to this set. Nets []string `json:"nets,omitempty" validate:"omitempty,dive,cidr"` // The list of domain names that belong to this set and are honored in egress allow rules // only. Domain names specified here only work to allow egress traffic from the cluster to // external destinations. They don't work to _deny_ traffic to destinations specified by // domain name, or to allow ingress traffic from _sources_ specified by domain name. AllowedEgressDomains []string `json:"allowedEgressDomains,omitempty" validate:"omitempty,dive,wildname"` }
NetworkSetSpec contains the specification for a NetworkSet resource.
func (*NetworkSetSpec) DeepCopy ¶
func (in *NetworkSetSpec) DeepCopy() *NetworkSetSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkSetSpec.
func (*NetworkSetSpec) DeepCopyInto ¶
func (in *NetworkSetSpec) DeepCopyInto(out *NetworkSetSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NodeControllerConfig ¶
type NodeControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation with the Calico datastore. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` // SyncLabels controls whether to copy Kubernetes node labels to Calico nodes. [Default: Enabled] SyncLabels string `json:"syncLabels,omitempty" validate:"omitempty,oneof=Enabled Disabled"` // HostEndpoint controls syncing nodes to host endpoints. Disabled by default, set to nil to disable. HostEndpoint *AutoHostEndpointConfig `json:"hostEndpoint,omitempty"` // LeakGracePeriod is the period used by the controller to determine if an IP address has been leaked. // Set to 0 to disable IP garbage collection. [Default: 15m] // +optional LeakGracePeriod *metav1.Duration `json:"leakGracePeriod,omitempty"` }
NodeControllerConfig configures the node controller, which automatically cleans up configuration for nodes that no longer exist. Optionally, it can create host endpoints for all Kubernetes nodes.
func (*NodeControllerConfig) DeepCopy ¶
func (in *NodeControllerConfig) DeepCopy() *NodeControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeControllerConfig.
func (*NodeControllerConfig) DeepCopyInto ¶
func (in *NodeControllerConfig) DeepCopyInto(out *NodeControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type NodeStatusClassType ¶
type NodeStatusClassType string
const ( NodeStatusClassTypeAgent NodeStatusClassType = "Agent" NodeStatusClassTypeBGP NodeStatusClassType = "BGP" NodeStatusClassTypeRoutes NodeStatusClassType = "Routes" )
type OverlayRoutingMode ¶
type OverlayRoutingMode string
const ( OverlayRoutingModeEnabled OverlayRoutingMode = "Enabled" OverlayRoutingModeDisabled OverlayRoutingMode = "Disabled" )
type PacketCapture ¶
type PacketCapture struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the PacketCapture. Spec PacketCaptureSpec `json:"spec,omitempty"` // Status of the PacketCapture Status PacketCaptureStatus `json:"status,omitempty"` }
PacketCapture contains the configuration for any packet capture.
func NewPacketCapture ¶
func NewPacketCapture() *PacketCapture
NewPacketCapture creates a new (zeroed) PacketCapture struct with the TypeMetadata initialised to the current version.
func (*PacketCapture) DeepCopy ¶
func (in *PacketCapture) DeepCopy() *PacketCapture
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCapture.
func (*PacketCapture) DeepCopyInto ¶
func (in *PacketCapture) DeepCopyInto(out *PacketCapture)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*PacketCapture) DeepCopyObject ¶
func (in *PacketCapture) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type PacketCaptureFile ¶
type PacketCaptureFile struct { // Node identifies with a physical node from the cluster via its hostname Node string `json:"node,omitempty" validate:"omitempty"` // Directory represents the path inside the calico-node container for the the generated files Directory string `json:"directory,omitempty" validate:"omitempty"` // FileNames represents the name of the generated file for a PacketCapture ordered alphanumerically. // The active packet capture file will be identified using the following schema: // "{workload endpoint name}_{host network interface}.pcap" . // Rotated capture files name will contain an index matching the rotation timestamp. FileNames []string `json:"fileNames,omitempty" validate:"omitempty,dive"` // +kubebuilder:validation:Enum=Capturing;Finished;Scheduled;Error;WaitingForTraffic State *PacketCaptureState `json:"state,omitempty" validate:"omitempty"` }
PacketCaptureFile describes files generated by a PacketCapture. It describes the location of the packet capture files that is identified via a node, its directory and the file names generated.
func (*PacketCaptureFile) DeepCopy ¶
func (in *PacketCaptureFile) DeepCopy() *PacketCaptureFile
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCaptureFile.
func (*PacketCaptureFile) DeepCopyInto ¶
func (in *PacketCaptureFile) DeepCopyInto(out *PacketCaptureFile)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PacketCaptureList ¶
type PacketCaptureList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []PacketCapture `json:"items"` }
PacketCaptureList contains a list of PacketCapture resources.
func NewPacketCaptureList ¶
func NewPacketCaptureList() *PacketCaptureList
NewPacketCaptureList creates a new (zeroed) PacketCaptureList struct with the TypeMetadata initialised to the current version.
func (*PacketCaptureList) DeepCopy ¶
func (in *PacketCaptureList) DeepCopy() *PacketCaptureList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCaptureList.
func (*PacketCaptureList) DeepCopyInto ¶
func (in *PacketCaptureList) DeepCopyInto(out *PacketCaptureList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*PacketCaptureList) DeepCopyObject ¶
func (in *PacketCaptureList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type PacketCaptureRule ¶
type PacketCaptureRule struct { // Protocol is an optional field that defines a filter for all traffic for // a specific IP protocol. // // Must be one of these string values: "TCP", "UDP", "ICMP", "ICMPv6", "SCTP", "UDPLite" // or an integer in the range 1-255. Protocol *numorstring.Protocol `json:"protocol,omitempty" validate:"omitempty"` // Ports is an optional field that defines a filter for all traffic that has a // source or destination port that matches one of these ranges/values. This value is a // list of integers or strings that represent ranges of ports. Ports []numorstring.Port `json:"ports,omitempty" validate:"omitempty,dive"` }
A PacketCaptureRule encapsulates a set of match criteria for traffic captured from an interface.
func (*PacketCaptureRule) DeepCopy ¶
func (in *PacketCaptureRule) DeepCopy() *PacketCaptureRule
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCaptureRule.
func (*PacketCaptureRule) DeepCopyInto ¶
func (in *PacketCaptureRule) DeepCopyInto(out *PacketCaptureRule)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PacketCaptureSpec ¶
type PacketCaptureSpec struct { // The selector is an expression used to pick out the endpoints that the policy should // be applied to. The selector will only match endpoints in the same namespace as the // PacketCapture resource. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() -> matches all endpoints. // an empty selector will default to all // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) // +kubebuilder:default:="all()" Selector string `json:"selector,omitempty" validate:"selector"` // The ordered set of filters applied to traffic captured from an interface. Each rule contains a set of // packet match criteria. Filters []PacketCaptureRule `json:"filters,omitempty" validate:"omitempty,dive"` // Defines the start time from which this PacketCapture will capture packets. // If omitted or the value is in the past, the capture will start immediately. // If the value is changed to a future time, capture will stop immediately and restart at that time // +optional // +kubebuilder:validation:Format="date-time" StartTime *metav1.Time `json:"startTime,omitempty" validate:"omitempty"` // Defines the end time at which this PacketCapture will stop capturing packets. // If omitted the capture will continue indefinitely. // If the value is changed to the past, capture will stop immediately. // +optional //+kubebuilder:validation:Format="date-time" EndTime *metav1.Time `json:"endTime,omitempty" validate:"omitempty"` }
PacketCaptureSpec contains the values of the packet capture.
func (*PacketCaptureSpec) DeepCopy ¶
func (in *PacketCaptureSpec) DeepCopy() *PacketCaptureSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCaptureSpec.
func (*PacketCaptureSpec) DeepCopyInto ¶
func (in *PacketCaptureSpec) DeepCopyInto(out *PacketCaptureSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PacketCaptureState ¶
type PacketCaptureState string
PacketCaptureState represents the state of the PacketCapture
type PacketCaptureStatus ¶
type PacketCaptureStatus struct {
Files []PacketCaptureFile `json:"files,omitempty"`
}
PacketCaptureStatus describes the files that have been captured, for a given PacketCapture, on each node that generates packet capture files
func (*PacketCaptureStatus) DeepCopy ¶
func (in *PacketCaptureStatus) DeepCopy() *PacketCaptureStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PacketCaptureStatus.
func (*PacketCaptureStatus) DeepCopyInto ¶
func (in *PacketCaptureStatus) DeepCopyInto(out *PacketCaptureStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyControllerConfig ¶
type PolicyControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation with the Calico datastore. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` }
PolicyControllerConfig configures the network policy controller, which syncs Kubernetes policies to Calico policies (only used for etcdv3 datastore).
func (*PolicyControllerConfig) DeepCopy ¶
func (in *PolicyControllerConfig) DeepCopy() *PolicyControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyControllerConfig.
func (*PolicyControllerConfig) DeepCopyInto ¶
func (in *PolicyControllerConfig) DeepCopyInto(out *PolicyControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyPerformanceHint ¶
type PolicyPerformanceHint string
const (
PerfHintAssumeNeededOnEveryNode PolicyPerformanceHint = "AssumeNeededOnEveryNode"
)
type PolicyRecommendationNamespaceStatus ¶
type PolicyRecommendationNamespaceStatus string
const ( PolicyRecommendationScopeEnabled PolicyRecommendationNamespaceStatus = "Enabled" PolicyRecommendationScopeDisabled PolicyRecommendationNamespaceStatus = "Disabled" )
type PolicyRecommendationScope ¶
type PolicyRecommendationScope struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec PolicyRecommendationScopeSpec `json:"spec,omitempty"` Status PolicyRecommendationScopeStatus `json:"status,omitempty"` }
+kubebuilder:subresource:status
func NewPolicyRecommendationScope ¶
func NewPolicyRecommendationScope() *PolicyRecommendationScope
NewPolicyRecommendationScope creates a new (zeroed) PolicyRecommendationScope struct. TypeMetadata initialized to the current version.
func (*PolicyRecommendationScope) DeepCopy ¶
func (in *PolicyRecommendationScope) DeepCopy() *PolicyRecommendationScope
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScope.
func (*PolicyRecommendationScope) DeepCopyInto ¶
func (in *PolicyRecommendationScope) DeepCopyInto(out *PolicyRecommendationScope)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*PolicyRecommendationScope) DeepCopyObject ¶
func (in *PolicyRecommendationScope) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type PolicyRecommendationScopeList ¶
type PolicyRecommendationScopeList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty"` Items []PolicyRecommendationScope `json:"items"` }
PolicyRecommendationList contains a list of Monitor
func NewPolicyRecommendationScopeList ¶
func NewPolicyRecommendationScopeList() *PolicyRecommendationScopeList
NewPolicyRecommendationScopeList creates a new (zeroed) PolicyRecommendationScopeList struct with the TypeMetadata initialized to the current version.
func (*PolicyRecommendationScopeList) DeepCopy ¶
func (in *PolicyRecommendationScopeList) DeepCopy() *PolicyRecommendationScopeList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScopeList.
func (*PolicyRecommendationScopeList) DeepCopyInto ¶
func (in *PolicyRecommendationScopeList) DeepCopyInto(out *PolicyRecommendationScopeList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*PolicyRecommendationScopeList) DeepCopyObject ¶
func (in *PolicyRecommendationScopeList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type PolicyRecommendationScopeNamespaceSpec ¶
type PolicyRecommendationScopeNamespaceSpec struct { // Pass intra-namespace traffic. // [Default: false] // +optional IntraNamespacePassThroughTraffic bool `json:"intraNamespacePassThroughTraffic,omitempty"` // Recommendation status. One of Enabled, Disabled. RecStatus PolicyRecommendationNamespaceStatus `json:"recStatus,omitempty" validate:"omitempty,policyrecstatus"` // The namespace selector is an expression used to pick out the namespaces that the policy // recommendation engine should create policies for. The syntax is the same as the // NetworkPolicy.projectcalico.org resource selectors. Selector string `json:"selector" validate:"selector"` // The name of the policy recommendation tier for namespace-isolated policies. // [Default: "namespace-isolation"] // +optional TierName string `json:"tierName,omitempty" validate:"omitempty,name"` }
PolicyRecommendationScopeNamespaceSpec contains namespace information that defines the namespace based recommended policy.
func (*PolicyRecommendationScopeNamespaceSpec) DeepCopy ¶
func (in *PolicyRecommendationScopeNamespaceSpec) DeepCopy() *PolicyRecommendationScopeNamespaceSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScopeNamespaceSpec.
func (*PolicyRecommendationScopeNamespaceSpec) DeepCopyInto ¶
func (in *PolicyRecommendationScopeNamespaceSpec) DeepCopyInto(out *PolicyRecommendationScopeNamespaceSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyRecommendationScopeSpec ¶
type PolicyRecommendationScopeSpec struct { // How frequently to run the recommendation engine to create and refine recommended policies. // [Default: 150s] // +optional Interval *metav1.Duration `json:"interval,omitempty"` // How far back to look in flow logs when first creating a recommended policy. // [Default: 24h] // +optional InitialLookback *metav1.Duration `json:"initialLookback,omitempty"` // StabilizationPeriod is the amount of time a recommended policy should remain unchanged to be // deemed stable and ready to be enforced. // [Default: 10m] // +optional StabilizationPeriod *metav1.Duration `json:"stabilizationPeriod,omitempty"` // The maximum number of rules that are permitted in the ingress or egress set. For egress rules, // any egress domain rules will be simplified by contracting all domains into a single egress // domain NetworkSet. If the number of rules exceeds this limit, the recommendation engine will // treat this as an error condition. // [Default: 20] // +optional MaxRules *int `json:"maxRules,omitempty"` // The number of staged policies that are actively learning at any one time, after which the // policy recommendation engine will stop adding new recommendations. // [Default: 20] // +optional PoliciesLearningCutOff *int `json:"policiesLearningCutOff,omitempty"` // The namespace spec contains the namespace relative recommendation vars. NamespaceSpec PolicyRecommendationScopeNamespaceSpec `json:"namespaceSpec,omitempty"` }
func (*PolicyRecommendationScopeSpec) DeepCopy ¶
func (in *PolicyRecommendationScopeSpec) DeepCopy() *PolicyRecommendationScopeSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScopeSpec.
func (*PolicyRecommendationScopeSpec) DeepCopyInto ¶
func (in *PolicyRecommendationScopeSpec) DeepCopyInto(out *PolicyRecommendationScopeSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyRecommendationScopeStatus ¶
type PolicyRecommendationScopeStatus struct {
Conditions []PolicyRecommendationScopeStatusCondition `json:"conditions,omitempty"`
}
func (*PolicyRecommendationScopeStatus) DeepCopy ¶
func (in *PolicyRecommendationScopeStatus) DeepCopy() *PolicyRecommendationScopeStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScopeStatus.
func (*PolicyRecommendationScopeStatus) DeepCopyInto ¶
func (in *PolicyRecommendationScopeStatus) DeepCopyInto(out *PolicyRecommendationScopeStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyRecommendationScopeStatusCondition ¶
type PolicyRecommendationScopeStatusCondition struct { Message string `json:"message,omitempty"` Reason string `json:"reason,omitempty"` Status PolicyRecommendationScopeStatusValue `json:"status"` Type PolicyRecommendationScopeStatusType `json:"type"` }
Condition contains various status information
func (*PolicyRecommendationScopeStatusCondition) DeepCopy ¶
func (in *PolicyRecommendationScopeStatusCondition) DeepCopy() *PolicyRecommendationScopeStatusCondition
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRecommendationScopeStatusCondition.
func (*PolicyRecommendationScopeStatusCondition) DeepCopyInto ¶
func (in *PolicyRecommendationScopeStatusCondition) DeepCopyInto(out *PolicyRecommendationScopeStatusCondition)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PolicyRecommendationScopeStatusType ¶
type PolicyRecommendationScopeStatusType string
type PolicyRecommendationScopeStatusValue ¶
type PolicyRecommendationScopeStatusValue string
type PolicyType ¶
type PolicyType string
PolicyType enumerates the possible values of the PolicySpec Types field.
const ( PolicyTypeIngress PolicyType = "Ingress" PolicyTypeEgress PolicyType = "Egress" )
type Position ¶
type Position struct { ID string `json:"id" validate:"servicegraphId"` XPos int `json:"xPos"` YPos int `json:"yPos"` ZPos int `json:"zPos"` }
UI screen position.
func (*Position) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Position.
func (*Position) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type PrefixAdvertisement ¶
type PrefixAdvertisement struct { // CIDR for which properties should be advertised. CIDR string `json:"cidr,omitempty" validate:"required,net"` // Communities can be list of either community names already defined in `Specs.Communities` or community value of format `aa:nn` or `aa:nn:mm`. // For standard community use `aa:nn` format, where `aa` and `nn` are 16 bit number. // For large community use `aa:nn:mm` format, where `aa`, `nn` and `mm` are 32 bit number. // Where,`aa` is an AS Number, `nn` and `mm` are per-AS identifier. Communities []string `json:"communities,omitempty" validate:"required"` }
PrefixAdvertisement configures advertisement properties for the specified CIDR.
func (*PrefixAdvertisement) DeepCopy ¶
func (in *PrefixAdvertisement) DeepCopy() *PrefixAdvertisement
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrefixAdvertisement.
func (*PrefixAdvertisement) DeepCopyInto ¶
func (in *PrefixAdvertisement) DeepCopyInto(out *PrefixAdvertisement)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Profile ¶
type Profile struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Spec ProfileSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"` }
func NewProfile ¶
func NewProfile() *Profile
NewProfile creates a new (zeroed) Profile struct with the TypeMetadata initialised to the current version.
func (*Profile) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Profile.
func (*Profile) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*Profile) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ProfileList ¶
type ProfileList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` Items []Profile `json:"items" protobuf:"bytes,2,rep,name=items"` }
ProfileList is a list of Profile objects.
func (*ProfileList) DeepCopy ¶
func (in *ProfileList) DeepCopy() *ProfileList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProfileList.
func (*ProfileList) DeepCopyInto ¶
func (in *ProfileList) DeepCopyInto(out *ProfileList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ProfileList) DeepCopyObject ¶
func (in *ProfileList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ProfileSpec ¶
type ProfileSpec struct { // The ordered set of ingress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"` // The ordered set of egress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"` // An option set of labels to apply to each endpoint (in addition to their own labels) // referencing this profile. If labels configured on the endpoint have keys matching those // labels inherited from the profile, the endpoint label values take precedence. LabelsToApply map[string]string `json:"labelsToApply,omitempty" validate:"omitempty,labels"` // Egress control. EgressGateway *EgressGatewaySpec `json:"egressGateway,omitempty" validate:"omitempty"` }
ProfileSpec contains the specification for a security Profile resource.
func (*ProfileSpec) DeepCopy ¶
func (in *ProfileSpec) DeepCopy() *ProfileSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProfileSpec.
func (*ProfileSpec) DeepCopyInto ¶
func (in *ProfileSpec) DeepCopyInto(out *ProfileSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ProtoPort ¶
type ProtoPort struct { Protocol string `json:"protocol"` Port uint16 `json:"port"` // +optional Net string `json:"net"` }
ProtoPort is combination of protocol, port, and CIDR. Protocol and port must be specified.
func (*ProtoPort) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProtoPort.
func (*ProtoPort) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Pull ¶
type Pull struct { Period string `json:"period,omitempty"` HTTP *HTTPPull `json:"http" validate:"required"` }
func (*Pull) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Pull.
func (*Pull) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RemoteClusterConfiguration ¶
type RemoteClusterConfiguration struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the RemoteClusterConfiguration. Spec RemoteClusterConfigurationSpec `json:"spec,omitempty"` }
RemoteClusterConfiguration contains the configuration for remote clusters.
func NewRemoteClusterConfiguration ¶
func NewRemoteClusterConfiguration() *RemoteClusterConfiguration
New RemoteClusterConfiguration creates a new (zeroed) RemoteClusterConfiguration struct with the TypeMetadata initialized to the current version.
func (*RemoteClusterConfiguration) DeepCopy ¶
func (in *RemoteClusterConfiguration) DeepCopy() *RemoteClusterConfiguration
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteClusterConfiguration.
func (*RemoteClusterConfiguration) DeepCopyInto ¶
func (in *RemoteClusterConfiguration) DeepCopyInto(out *RemoteClusterConfiguration)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*RemoteClusterConfiguration) DeepCopyObject ¶
func (in *RemoteClusterConfiguration) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type RemoteClusterConfigurationList ¶
type RemoteClusterConfigurationList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []RemoteClusterConfiguration `json:"items"` }
RemoteClusterConfigurationList contains a list of RemoteClusterConfiguration resources
func NewRemoteClusterConfigurationList ¶
func NewRemoteClusterConfigurationList() *RemoteClusterConfigurationList
NewRemoteClusterConfigurationList creates a new (zeroed) RemoteClusterConfigurationList struct with the TypeMetadata initialized to the current version.
func (*RemoteClusterConfigurationList) DeepCopy ¶
func (in *RemoteClusterConfigurationList) DeepCopy() *RemoteClusterConfigurationList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteClusterConfigurationList.
func (*RemoteClusterConfigurationList) DeepCopyInto ¶
func (in *RemoteClusterConfigurationList) DeepCopyInto(out *RemoteClusterConfigurationList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*RemoteClusterConfigurationList) DeepCopyObject ¶
func (in *RemoteClusterConfigurationList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type RemoteClusterConfigurationSpec ¶
type RemoteClusterConfigurationSpec struct { // Indicates the datastore to use. If unspecified, defaults to etcdv3 DatastoreType string `json:"datastoreType,omitempty" validate:"omitempty,datastoreType"` // Specifies a Secret to read for the RemoteClusterconfiguration. // If defined all datastore configuration in this struct will be cleared // and overwritten with the appropriate fields in the Secret. ClusterAccessSecret *k8sv1.ObjectReference `json:"clusterAccessSecret,omitempty" validate:"omitempty,clusterAccessSecret"` // Inline the ectd config fields EtcdConfig `json:",inline"` // Inline the k8s config fields. KubeConfig `json:",inline"` // Configuration options that do not relate to the underlying datastore connection. These fields relate to the // syncing of resources once the connection is established. These fields can be set independent of the other // connection-oriented fields, e.g. they can be set when ClusterAccessSecret is non-nil. // +kubebuilder:default={overlayRoutingMode: "Disabled"} SyncOptions RemoteClusterSyncOptions `json:"syncOptions,omitempty"` }
RemoteClusterConfigurationSpec contains the values of describing the cluster.
func (*RemoteClusterConfigurationSpec) DeepCopy ¶
func (in *RemoteClusterConfigurationSpec) DeepCopy() *RemoteClusterConfigurationSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteClusterConfigurationSpec.
func (*RemoteClusterConfigurationSpec) DeepCopyInto ¶
func (in *RemoteClusterConfigurationSpec) DeepCopyInto(out *RemoteClusterConfigurationSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RemoteClusterSyncOptions ¶
type RemoteClusterSyncOptions struct { // Determines whether overlay routing will be established between federated clusters. If unspecified during create or // update of RemoteClusterConfiguration, this field will default based on the encapsulation mode of the local cluster // at the time of RemoteClusterConfiguration application: "Enabled" if VXLAN, "Disabled" otherwise. If upgrading from // a version that predates this field, this field will default to "Disabled". // +kubebuilder:default=Disabled OverlayRoutingMode OverlayRoutingMode `json:"overlayRoutingMode,omitempty" validate:"omitempty,oneof=Enabled Disabled"` }
func (*RemoteClusterSyncOptions) DeepCopy ¶
func (in *RemoteClusterSyncOptions) DeepCopy() *RemoteClusterSyncOptions
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RemoteClusterSyncOptions.
func (*RemoteClusterSyncOptions) DeepCopyInto ¶
func (in *RemoteClusterSyncOptions) DeepCopyInto(out *RemoteClusterSyncOptions)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportData ¶
type ReportData struct { ReportName string `json:"reportName"` ReportTypeName string `json:"reportTypeName"` ReportSpec ReportSpec `json:"reportSpec"` ReportTypeSpec ReportTypeSpec `json:"reportTypeSpec"` StartTime metav1.Time `json:"startTime"` EndTime metav1.Time `json:"endTime"` GenerationTime metav1.Time `json:"generationTime"` // The set of in-scope endpoints. Endpoints []EndpointsReportEndpoint `json:"endpoints,omitempty"` // Endpoint stats in a reporting period. EndpointsSummary EndpointsSummary `json:"endpointsSummary,omitempty"` // The set of namespaces containing in-scope endpoints. Namespaces []EndpointsReportNamespace `json:"namespaces,omitempty"` // Endpoint stats for given namespaces in a reporting period. NamespacesSummary EndpointsSummary `json:"namespacesSummary,omitempty"` // The set of services containing in-scope endpoints. Services []EndpointsReportService `json:"services,omitempty"` // Endpoint stats for services in a reporting period. ServicesSummary EndpointsSummary `json:"servicesSummary,omitempty"` // The time-ordered set of in-scope audit events that occurred within the reporting interval. AuditEvents []audit.Event `json:"auditEvents,omitempty"` // Audit log stats in a reporting period. AuditSummary AuditSummary `json:"auditSummary,omitempty"` // Flows for in-scope endpoints that have been recorded within the reporting period. Flows []EndpointsReportFlow `json:"flows,omitempty"` // CISBenchmark contains the per-node results of a cis benchmark scan. CISBenchmark []CISBenchmarkNode `json:"cisBenchmark,omitempty"` // CISBenchmarkSummary high level test results. CISBenchmarkSummary CISBenchmarkSummary `json:"cisBenchmarkSummary,omitempty"` }
ReportData contains the aggregated data available for rendering in report templates. The data available is dependent on the selector/report configuration.
The data is stored directly in elastic search. To reduce nesting and simplify indexing, all summary values are contained at the top level.
func (*ReportData) DeepCopy ¶
func (in *ReportData) DeepCopy() *ReportData
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportData.
func (*ReportData) DeepCopyInto ¶
func (in *ReportData) DeepCopyInto(out *ReportData)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportJob ¶
type ReportJob struct { // The start time of the report. Start metav1.Time `json:"start"` // The end time of the report. End metav1.Time `json:"end"` // A reference to the report creation job if known. Job *corev1.ObjectReference `json:"job"` }
ReportJob contains
func (*ReportJob) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportJob.
func (*ReportJob) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportSpec ¶
type ReportSpec struct { // The name of the report type. ReportType string `json:"reportType" validate:"name,required"` // Endpoints is used to specify which endpoints are in-scope and stored in the generated report data. // Only used if endpoints data and/or audit logs are gathered in the report. If omitted, treated as everything // in-scope. Endpoints *EndpointsSelection `json:"endpoints,omitempty" validate:"omitempty,selector"` // The report schedule specified in cron format. This specifies both the start and end times of each report, // where the end time of one report becomes the start time of the next report. // Separate jobs are created to generate a report, and the job generates the report data from archived audit // and traffic data. To ensure this data is actually archived, the jobs to generate each report starts at a // configurable time *after* the end time of the report that is being generated. The default job start delay is // 30m, but is configurable through the compliance-controller environments. // The cron format has minute accuracy, but only up to two values may be configured for the minute column which // means you may only have at most two reports for each hour period. Schedule string `json:"schedule,omitempty" validate:"omitempty"` // The node selector used to specify which nodes the report job may be scheduled on. JobNodeSelector map[string]string `json:"jobNodeSelector,omitempty" validate:"omitempty"` // This flag tells the controller to suspend subsequent jobs for generating reports, it does not apply to already // started jobs. If jobs are resumed then the controller will start creating jobs for any reports that were missed // while the job was suspended. Suspend *bool `json:"suspend,omitempty" validate:"omitempty"` // This field contain all the parameters for configuring a CIS benchmark report. CIS *CISBenchmarkParams `json:"cis,omitempty" validate:"omitempty"` }
ReportSpec contains the values of the GlobalReport.
func (*ReportSpec) DeepCopy ¶
func (in *ReportSpec) DeepCopy() *ReportSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportSpec.
func (*ReportSpec) DeepCopyInto ¶
func (in *ReportSpec) DeepCopyInto(out *ReportSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportStatus ¶
type ReportStatus struct { // The configured report jobs that have completed successfully. LastSuccessfulReportJobs []CompletedReportJob `json:"lastSuccessfulReportJobs,omitempty"` // The configured report jobs that have failed. LastFailedReportJobs []CompletedReportJob `json:"lastFailedReportJobs,omitempty"` // The set of active report jobs. ActiveReportJobs []ReportJob `json:"activeReportJobs,omitempty"` // The last scheduled report job. LastScheduledReportJob *ReportJob `json:"lastScheduledReportJob,omitempty"` }
ReportStatus contains the status of the automated report generation.
func (*ReportStatus) DeepCopy ¶
func (in *ReportStatus) DeepCopy() *ReportStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportStatus.
func (*ReportStatus) DeepCopyInto ¶
func (in *ReportStatus) DeepCopyInto(out *ReportStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportTemplate ¶
type ReportTemplate struct { // The name of this template. This should be unique across all template names within a ReportType. This will be used // by the UI as the suffix of the downloadable file name. Name string `json:"name,omitempty" validate:"name,required"` // A user-facing description of the template. Description string `json:"description,omitempty"` // The base-64 encoded go template used to render the report data. Template string `json:"template,omitempty" validate:"required"` }
ReportTemplate defines a template used to render a report into downloadable or UI compatible format.
func (*ReportTemplate) DeepCopy ¶
func (in *ReportTemplate) DeepCopy() *ReportTemplate
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportTemplate.
func (*ReportTemplate) DeepCopyInto ¶
func (in *ReportTemplate) DeepCopyInto(out *ReportTemplate)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ReportTypeSpec ¶
type ReportTypeSpec struct { // The summary template, explicitly used by the UI to render a summary version of the report. This should render // to json containing a sets of widgets that the UI can use to render the summary. The rendered data is returned // on the list query of the reports. UISummaryTemplate ReportTemplate `json:"uiSummaryTemplate,omitempty" validate:"required"` // The set of templates used to render the report for downloads. DownloadTemplates []ReportTemplate `json:"downloadTemplates,omitempty" validate:"dive"` // Whether to include endpoint data in the report. The actual endpoints included may be filtered by the Report, // but will otherwise contain the full set of endpoints. IncludeEndpointData bool `json:"includeEndpointData,omitempty"` // Whether to include endpoint-to-endpoint flow log data in the report. IncludeEndpointFlowLogData bool `json:"includeEndpointFlowLogData,omitempty"` // What audit log data should be included in the report. If not specified, the report will contain no audit log // data. The selection may be further filtered by the Report. AuditEventsSelection *AuditEventsSelection `json:"auditEventsSelection,omitempty" validate:"omitempty"` // Whether to include the full cis benchmark test results in the report. IncludeCISBenchmarkData bool `json:"includeCISBenchmarkData,omitempty"` }
ReportTypeSpec contains the various templates, and configuration used to render a specific type of report.
func (*ReportTypeSpec) DeepCopy ¶
func (in *ReportTypeSpec) DeepCopy() *ReportTypeSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ReportTypeSpec.
func (*ReportTypeSpec) DeepCopyInto ¶
func (in *ReportTypeSpec) DeepCopyInto(out *ReportTypeSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ResourceID ¶
type ResourceID struct { metav1.TypeMeta `json:",inline"` Name string `json:"name,omitempty" validate:"omitempty"` Namespace string `json:"namespace,omitempty" validate:"omitempty"` UUID types.UID `json:"uuid,omitempty" validate:"omitempty"` }
ResourceID is used to identify a resource instance in the report data.
func (*ResourceID) DeepCopy ¶
func (in *ResourceID) DeepCopy() *ResourceID
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceID.
func (*ResourceID) DeepCopyInto ¶
func (in *ResourceID) DeepCopyInto(out *ResourceID)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (ResourceID) String ¶
func (resource ResourceID) String() (expanded string)
Prints ResourceID contents.
type RestartMode ¶
type RestartMode string
const ( RestartModeGracefulRestart RestartMode = "GracefulRestart" RestartModeLongLivedGracefulRestart RestartMode = "LongLivedGracefulRestart" )
type RouteTableIDRange ¶
func (*RouteTableIDRange) DeepCopy ¶
func (in *RouteTableIDRange) DeepCopy() *RouteTableIDRange
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteTableIDRange.
func (*RouteTableIDRange) DeepCopyInto ¶
func (in *RouteTableIDRange) DeepCopyInto(out *RouteTableIDRange)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RouteTableRange ¶
func (*RouteTableRange) DeepCopy ¶
func (in *RouteTableRange) DeepCopy() *RouteTableRange
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteTableRange.
func (*RouteTableRange) DeepCopyInto ¶
func (in *RouteTableRange) DeepCopyInto(out *RouteTableRange)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RouteTableRanges ¶
type RouteTableRanges []RouteTableIDRange
func (RouteTableRanges) DeepCopy ¶
func (in RouteTableRanges) DeepCopy() RouteTableRanges
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteTableRanges.
func (RouteTableRanges) DeepCopyInto ¶
func (in RouteTableRanges) DeepCopyInto(out *RouteTableRanges)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (RouteTableRanges) NumDesignatedTables ¶
func (r RouteTableRanges) NumDesignatedTables() int
type Rule ¶
type Rule struct { Action Action `json:"action" validate:"action"` // IPVersion is an optional field that restricts the rule to only match a specific IP // version. IPVersion *int `json:"ipVersion,omitempty" validate:"omitempty,ipVersion"` // Protocol is an optional field that restricts the rule to only apply to traffic of // a specific IP protocol. Required if any of the EntityRules contain Ports // (because ports only apply to certain protocols). // // Must be one of these string values: "TCP", "UDP", "ICMP", "ICMPv6", "SCTP", "UDPLite" // or an integer in the range 1-255. Protocol *numorstring.Protocol `json:"protocol,omitempty" validate:"omitempty"` // ICMP is an optional field that restricts the rule to apply to a specific type and // code of ICMP traffic. This should only be specified if the Protocol field is set to // "ICMP" or "ICMPv6". ICMP *ICMPFields `json:"icmp,omitempty" validate:"omitempty"` // NotProtocol is the negated version of the Protocol field. NotProtocol *numorstring.Protocol `json:"notProtocol,omitempty" validate:"omitempty"` // NotICMP is the negated version of the ICMP field. NotICMP *ICMPFields `json:"notICMP,omitempty" validate:"omitempty"` // Source contains the match criteria that apply to source entity. Source EntityRule `json:"source,omitempty" validate:"omitempty"` // Destination contains the match criteria that apply to destination entity. Destination EntityRule `json:"destination,omitempty" validate:"omitempty"` // HTTP contains match criteria that apply to HTTP requests. HTTP *HTTPMatch `json:"http,omitempty" validate:"omitempty"` // Metadata contains additional information for this rule Metadata *RuleMetadata `json:"metadata,omitempty" validate:"omitempty"` }
A Rule encapsulates a set of match criteria and an action. Both selector-based security Policy and security Profiles reference rules - separated out as a list of rules for both ingress and egress packet matching.
Each positive match criteria has a negated version, prefixed with "Not". All the match criteria within a rule must be satisfied for a packet to match. A single rule can contain the positive and negative version of a match and both must be satisfied for the rule to match.
func (*Rule) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.
func (*Rule) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type RuleMetadata ¶
type RuleMetadata struct { // Annotations is a set of key value pairs that give extra information about the rule Annotations map[string]string `json:"annotations,omitempty"` }
func (*RuleMetadata) DeepCopy ¶
func (in *RuleMetadata) DeepCopy() *RuleMetadata
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RuleMetadata.
func (*RuleMetadata) DeepCopyInto ¶
func (in *RuleMetadata) DeepCopyInto(out *RuleMetadata)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecurityEventWebhook ¶
type SecurityEventWebhook struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` Status []metav1.Condition `json:"status,omitempty" validate:"omitempty"` Spec SecurityEventWebhookSpec `json:"spec" validate:"required"` }
func NewSecurityEventWebhook ¶
func NewSecurityEventWebhook() *SecurityEventWebhook
NewSecurityEventWebhook creates a new SecurityEventWebhook struct with the TypeMetadata initialized to the current API version.
func (*SecurityEventWebhook) DeepCopy ¶
func (in *SecurityEventWebhook) DeepCopy() *SecurityEventWebhook
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityEventWebhook.
func (*SecurityEventWebhook) DeepCopyInto ¶
func (in *SecurityEventWebhook) DeepCopyInto(out *SecurityEventWebhook)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecurityEventWebhook) DeepCopyObject ¶
func (in *SecurityEventWebhook) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type SecurityEventWebhookConfigVar ¶
type SecurityEventWebhookConfigVar struct { Name string `json:"name" protobuf:"bytes,1,opt,name=name"` // +optional Value string `json:"value,omitempty"` // +optional ValueFrom *SecurityEventWebhookConfigVarSource `json:"valueFrom,omitempty"` }
func (*SecurityEventWebhookConfigVar) DeepCopy ¶
func (in *SecurityEventWebhookConfigVar) DeepCopy() *SecurityEventWebhookConfigVar
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityEventWebhookConfigVar.
func (*SecurityEventWebhookConfigVar) DeepCopyInto ¶
func (in *SecurityEventWebhookConfigVar) DeepCopyInto(out *SecurityEventWebhookConfigVar)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecurityEventWebhookConfigVarSource ¶
type SecurityEventWebhookConfigVarSource struct { // +optional ConfigMapKeyRef *corev1.ConfigMapKeySelector `json:"configMapKeyRef,omitempty" protobuf:"bytes,3,opt,name=configMapKeyRef"` // +optional SecretKeyRef *corev1.SecretKeySelector `json:"secretKeyRef,omitempty" protobuf:"bytes,4,opt,name=secretKeyRef"` }
func (*SecurityEventWebhookConfigVarSource) DeepCopy ¶
func (in *SecurityEventWebhookConfigVarSource) DeepCopy() *SecurityEventWebhookConfigVarSource
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityEventWebhookConfigVarSource.
func (*SecurityEventWebhookConfigVarSource) DeepCopyInto ¶
func (in *SecurityEventWebhookConfigVarSource) DeepCopyInto(out *SecurityEventWebhookConfigVarSource)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecurityEventWebhookConsumer ¶
type SecurityEventWebhookConsumer string
type SecurityEventWebhookList ¶
type SecurityEventWebhookList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []SecurityEventWebhook `json:"items"` }
func NewSecurityEventWebhookList ¶
func NewSecurityEventWebhookList() *SecurityEventWebhookList
NewSecurityEventWebhookList creates a new SecurityEventWebhookList struct with the TypeMetadata initialized to the current API version.
func (*SecurityEventWebhookList) DeepCopy ¶
func (in *SecurityEventWebhookList) DeepCopy() *SecurityEventWebhookList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityEventWebhookList.
func (*SecurityEventWebhookList) DeepCopyInto ¶
func (in *SecurityEventWebhookList) DeepCopyInto(out *SecurityEventWebhookList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecurityEventWebhookList) DeepCopyObject ¶
func (in *SecurityEventWebhookList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type SecurityEventWebhookSpec ¶
type SecurityEventWebhookSpec struct { // indicates the SecurityEventWebhook intended consumer, one of: Slack, Jira Consumer SecurityEventWebhookConsumer `json:"consumer" validate:"required,oneof=Slack Jira Generic"` // defines the webhook desired state, one of: Enabled, Disabled or Debug State SecurityEventWebhookState `json:"state" validate:"required,oneof=Enabled Disabled Debug"` // defines the SecurityEventWebhook query to be executed against fields of SecurityEvents Query string `json:"query" validate:"required"` // contains the SecurityEventWebhook's configuration associated with the intended Consumer Config []SecurityEventWebhookConfigVar `json:"config" validate:"required"` }
func (*SecurityEventWebhookSpec) DeepCopy ¶
func (in *SecurityEventWebhookSpec) DeepCopy() *SecurityEventWebhookSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityEventWebhookSpec.
func (*SecurityEventWebhookSpec) DeepCopyInto ¶
func (in *SecurityEventWebhookSpec) DeepCopyInto(out *SecurityEventWebhookSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecurityEventWebhookState ¶
type SecurityEventWebhookState string
type ServiceAccountControllerConfig ¶
type ServiceAccountControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation with the Calico datastore. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` }
ServiceAccountControllerConfig configures the service account controller, which syncs Kubernetes service accounts to Calico profiles (only used for etcdv3 datastore).
func (*ServiceAccountControllerConfig) DeepCopy ¶
func (in *ServiceAccountControllerConfig) DeepCopy() *ServiceAccountControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountControllerConfig.
func (*ServiceAccountControllerConfig) DeepCopyInto ¶
func (in *ServiceAccountControllerConfig) DeepCopyInto(out *ServiceAccountControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceAccountMatch ¶
type ServiceAccountMatch struct { // Names is an optional field that restricts the rule to only apply to traffic that originates from (or terminates // at) a pod running as a service account whose name is in the list. Names []string `json:"names,omitempty" validate:"omitempty"` // Selector is an optional field that restricts the rule to only apply to traffic that originates from // (or terminates at) a pod running as a service account that matches the given label selector. // If both Names and Selector are specified then they are AND'ed. Selector string `json:"selector,omitempty" validate:"omitempty,selector"` }
func (*ServiceAccountMatch) DeepCopy ¶
func (in *ServiceAccountMatch) DeepCopy() *ServiceAccountMatch
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceAccountMatch.
func (*ServiceAccountMatch) DeepCopyInto ¶
func (in *ServiceAccountMatch) DeepCopyInto(out *ServiceAccountMatch)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceClusterIPBlock ¶
type ServiceClusterIPBlock struct {
CIDR string `json:"cidr,omitempty" validate:"omitempty,net"`
}
ServiceClusterIPBlock represents a single allowed ClusterIP CIDR block.
func (*ServiceClusterIPBlock) DeepCopy ¶
func (in *ServiceClusterIPBlock) DeepCopy() *ServiceClusterIPBlock
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceClusterIPBlock.
func (*ServiceClusterIPBlock) DeepCopyInto ¶
func (in *ServiceClusterIPBlock) DeepCopyInto(out *ServiceClusterIPBlock)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceExternalIPBlock ¶
type ServiceExternalIPBlock struct {
CIDR string `json:"cidr,omitempty" validate:"omitempty,net"`
}
ServiceExternalIPBlock represents a single allowed External IP CIDR block.
func (*ServiceExternalIPBlock) DeepCopy ¶
func (in *ServiceExternalIPBlock) DeepCopy() *ServiceExternalIPBlock
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceExternalIPBlock.
func (*ServiceExternalIPBlock) DeepCopyInto ¶
func (in *ServiceExternalIPBlock) DeepCopyInto(out *ServiceExternalIPBlock)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceLoadBalancerIPBlock ¶
type ServiceLoadBalancerIPBlock struct {
CIDR string `json:"cidr,omitempty" validate:"omitempty,net"`
}
ServiceLoadBalancerIPBlock represents a single allowed LoadBalancer IP CIDR block.
func (*ServiceLoadBalancerIPBlock) DeepCopy ¶
func (in *ServiceLoadBalancerIPBlock) DeepCopy() *ServiceLoadBalancerIPBlock
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceLoadBalancerIPBlock.
func (*ServiceLoadBalancerIPBlock) DeepCopyInto ¶
func (in *ServiceLoadBalancerIPBlock) DeepCopyInto(out *ServiceLoadBalancerIPBlock)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ServiceMatch ¶
type ServiceMatch struct { // Name specifies the name of a Kubernetes Service to match. Name string `json:"name,omitempty" validate:"omitempty,name"` // Namespace specifies the namespace of the given Service. If left empty, the rule // will match within this policy's namespace. Namespace string `json:"namespace,omitempty" validate:"omitempty,name"` }
func (*ServiceMatch) DeepCopy ¶
func (in *ServiceMatch) DeepCopy() *ServiceMatch
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceMatch.
func (*ServiceMatch) DeepCopyInto ¶
func (in *ServiceMatch) DeepCopyInto(out *ServiceMatch)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SourceAddress ¶
type SourceAddress string
const ( SourceAddressUseNodeIP SourceAddress = "UseNodeIP" SourceAddressNone SourceAddress = "None" )
type StagedAction ¶
type StagedAction string
const ( StagedActionSet StagedAction = "Set" StagedActionDelete StagedAction = "Delete" StagedActionLearn StagedAction = "Learn" StagedActionIgnore StagedAction = "Ignore" )
func ConvertStagedKubernetesPolicyToK8SEnforced ¶
func ConvertStagedKubernetesPolicyToK8SEnforced(staged *StagedKubernetesNetworkPolicy) (StagedAction, *networkingv1.NetworkPolicy)
ConvertStagedKubernetesPolicyToK8SEnforced converts a StagedKubernetesNetworkPolicy into a StagedAction, networkingv1 NetworkPolicy pair
type StagedGlobalNetworkPolicy ¶
type StagedGlobalNetworkPolicy struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the Policy. Spec StagedGlobalNetworkPolicySpec `json:"spec,omitempty"` }
StagedGlobalNetworkPolicy is a staged GlobalNetworkPolicy.
func NewStagedGlobalNetworkPolicy ¶
func NewStagedGlobalNetworkPolicy() *StagedGlobalNetworkPolicy
NewStagedGlobalNetworkPolicy creates a new (zeroed) StagedGlobalNetworkPolicy struct with the TypeMetadata initialised to the current version.
func (*StagedGlobalNetworkPolicy) DeepCopy ¶
func (in *StagedGlobalNetworkPolicy) DeepCopy() *StagedGlobalNetworkPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedGlobalNetworkPolicy.
func (*StagedGlobalNetworkPolicy) DeepCopyInto ¶
func (in *StagedGlobalNetworkPolicy) DeepCopyInto(out *StagedGlobalNetworkPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedGlobalNetworkPolicy) DeepCopyObject ¶
func (in *StagedGlobalNetworkPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedGlobalNetworkPolicyList ¶
type StagedGlobalNetworkPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []StagedGlobalNetworkPolicy `json:"items"` }
StagedGlobalNetworkPolicyList contains a list of GlobalNetworkPolicy resources.
func NewStagedGlobalNetworkPolicyList ¶
func NewStagedGlobalNetworkPolicyList() *StagedGlobalNetworkPolicyList
NewStagedGlobalNetworkPolicyList creates a new (zeroed) StagedGlobalNetworkPolicyList struct with the TypeMetadata initialised to the current version.
func (*StagedGlobalNetworkPolicyList) DeepCopy ¶
func (in *StagedGlobalNetworkPolicyList) DeepCopy() *StagedGlobalNetworkPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedGlobalNetworkPolicyList.
func (*StagedGlobalNetworkPolicyList) DeepCopyInto ¶
func (in *StagedGlobalNetworkPolicyList) DeepCopyInto(out *StagedGlobalNetworkPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedGlobalNetworkPolicyList) DeepCopyObject ¶
func (in *StagedGlobalNetworkPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedGlobalNetworkPolicySpec ¶
type StagedGlobalNetworkPolicySpec struct { // The staged action. If this is omitted, the default is Set. StagedAction StagedAction `json:"stagedAction,omitempty" validate:"omitempty,stagedAction"` // The name of the tier that this policy belongs to. If this is omitted, the default // tier (name is "default") is assumed. The specified tier must exist in order to create // security policies within the tier, the "default" tier is created automatically if it // does not exist, this means for deployments requiring only a single Tier, the tier name // may be omitted on all policy management requests. Tier string `json:"tier,omitempty" validate:"omitempty,name"` // Order is an optional field that specifies the order in which the policy is applied. // Policies with higher "order" are applied after those with lower // order within the same tier. If the order is omitted, it may be considered to be "infinite" - i.e. the // policy will be applied last. Policies with identical order will be applied in // alphanumerical order based on the Policy "Name" within the tier. Order *float64 `json:"order,omitempty"` // The ordered set of ingress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"` // The ordered set of egress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"` // The selector is an expression used to pick pick out the endpoints that the policy should // be applied to. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() or the empty selector -> matches all endpoints. // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) Selector string `json:"selector,omitempty" validate:"selector"` // Types indicates whether this policy applies to ingress, or to egress, or to both. When // not explicitly specified (and so the value on creation is empty or nil), Calico defaults // Types according to what Ingress and Egress rules are present in the policy. The // default is: // // - [ PolicyTypeIngress ], if there are no Egress rules (including the case where there are // also no Ingress rules) // // - [ PolicyTypeEgress ], if there are Egress rules but no Ingress rules // // - [ PolicyTypeIngress, PolicyTypeEgress ], if there are both Ingress and Egress rules. // // When the policy is read back again, Types will always be one of these values, never empty // or nil. Types []PolicyType `json:"types,omitempty" validate:"omitempty,dive,policyType"` // DoNotTrack indicates whether packets matched by the rules in this policy should go through // the data plane's connection tracking, such as Linux conntrack. If True, the rules in // this policy are applied before any data plane connection tracking, and packets allowed by // this policy are marked as not to be tracked. DoNotTrack bool `json:"doNotTrack,omitempty"` // PreDNAT indicates to apply the rules in this policy before any DNAT. PreDNAT bool `json:"preDNAT,omitempty"` // ApplyOnForward indicates to apply the rules in this policy on forward traffic. ApplyOnForward bool `json:"applyOnForward,omitempty"` // ServiceAccountSelector is an optional field for an expression used to select a pod based on service accounts. ServiceAccountSelector string `json:"serviceAccountSelector,omitempty" validate:"selector"` // NamespaceSelector is an optional field for an expression used to select a pod based on namespaces. NamespaceSelector string `json:"namespaceSelector,omitempty" validate:"selector"` // PerformanceHints contains a list of hints to Calico's policy engine to // help process the policy more efficiently. Hints never change the // enforcement behaviour of the policy. // // Currently, the only available hint is "AssumeNeededOnEveryNode". When // that hint is set on a policy, Felix will act as if the policy matches // a local endpoint even if it does not. This is useful for "preloading" // any large static policies that are known to be used on every node. // If the policy is _not_ used on a particular node then the work // done to preload the policy (and to maintain it) is wasted. PerformanceHints []PolicyPerformanceHint `json:"performanceHints,omitempty" validate:"omitempty,unique,dive,oneof=AssumeNeededOnEveryNode"` }
func (*StagedGlobalNetworkPolicySpec) DeepCopy ¶
func (in *StagedGlobalNetworkPolicySpec) DeepCopy() *StagedGlobalNetworkPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedGlobalNetworkPolicySpec.
func (*StagedGlobalNetworkPolicySpec) DeepCopyInto ¶
func (in *StagedGlobalNetworkPolicySpec) DeepCopyInto(out *StagedGlobalNetworkPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type StagedKubernetesNetworkPolicy ¶
type StagedKubernetesNetworkPolicy struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the Policy. Spec StagedKubernetesNetworkPolicySpec `json:"spec,omitempty"` }
StagedKubernetesNetworkPolicy is a staged GlobalNetworkPolicy.
func NewStagedKubernetesNetworkPolicy ¶
func NewStagedKubernetesNetworkPolicy() *StagedKubernetesNetworkPolicy
NewStagedKubernetesNetworkPolicy creates a new (zeroed) StagedKubernetesNetworkPolicy struct with the TypeMetadata initialised to the current version.
func (*StagedKubernetesNetworkPolicy) DeepCopy ¶
func (in *StagedKubernetesNetworkPolicy) DeepCopy() *StagedKubernetesNetworkPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedKubernetesNetworkPolicy.
func (*StagedKubernetesNetworkPolicy) DeepCopyInto ¶
func (in *StagedKubernetesNetworkPolicy) DeepCopyInto(out *StagedKubernetesNetworkPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedKubernetesNetworkPolicy) DeepCopyObject ¶
func (in *StagedKubernetesNetworkPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedKubernetesNetworkPolicyList ¶
type StagedKubernetesNetworkPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []StagedKubernetesNetworkPolicy `json:"items"` }
StagedKubernetesNetworkPolicyList contains a list of StagedKubernetesNetworkPolicy resources.
func NewStagedKubernetesNetworkPolicyList ¶
func NewStagedKubernetesNetworkPolicyList() *StagedKubernetesNetworkPolicyList
NewStagedKubernetesNetworkPolicyList creates a new (zeroed) StagedKubernetesNetworkPolicyList struct with the TypeMetadata initialised to the current version.
func (*StagedKubernetesNetworkPolicyList) DeepCopy ¶
func (in *StagedKubernetesNetworkPolicyList) DeepCopy() *StagedKubernetesNetworkPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedKubernetesNetworkPolicyList.
func (*StagedKubernetesNetworkPolicyList) DeepCopyInto ¶
func (in *StagedKubernetesNetworkPolicyList) DeepCopyInto(out *StagedKubernetesNetworkPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedKubernetesNetworkPolicyList) DeepCopyObject ¶
func (in *StagedKubernetesNetworkPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedKubernetesNetworkPolicySpec ¶
type StagedKubernetesNetworkPolicySpec struct { // The staged action. If this is omitted, the default is Set. StagedAction StagedAction `json:"stagedAction,omitempty" validate:"omitempty,stagedAction"` // Selects the pods to which this NetworkPolicy object applies. The array of // ingress rules is applied to any pods selected by this field. Multiple network // policies can select the same set of pods. In this case, the ingress rules for // each are combined additively. This field is NOT optional and follows standard // label selector semantics. An empty podSelector matches all pods in this // namespace. PodSelector metav1.LabelSelector `json:"podSelector,omitempty" protobuf:"bytes,1,opt,name=podSelector"` // List of ingress rules to be applied to the selected pods. Traffic is allowed to // a pod if there are no NetworkPolicies selecting the pod // (and cluster policy otherwise allows the traffic), OR if the traffic source is // the pod's local node, OR if the traffic matches at least one ingress rule // across all of the NetworkPolicy objects whose podSelector matches the pod. If // this field is empty then this NetworkPolicy does not allow any traffic (and serves // solely to ensure that the pods it selects are isolated by default) // +optional Ingress []networkingv1.NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"` // List of egress rules to be applied to the selected pods. Outgoing traffic is // allowed if there are no NetworkPolicies selecting the pod (and cluster policy // otherwise allows the traffic), OR if the traffic matches at least one egress rule // across all of the NetworkPolicy objects whose podSelector matches the pod. If // this field is empty then this NetworkPolicy limits all outgoing traffic (and serves // solely to ensure that the pods it selects are isolated by default). // This field is beta-level in 1.8 // +optional Egress []networkingv1.NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"` // List of rule types that the NetworkPolicy relates to. // Valid options are Ingress, Egress, or Ingress,Egress. // If this field is not specified, it will default based on the existence of Ingress or Egress rules; // policies that contain an Egress section are assumed to affect Egress, and all policies // (whether or not they contain an Ingress section) are assumed to affect Ingress. // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. // Likewise, if you want to write a policy that specifies that no egress is allowed, // you must specify a policyTypes value that include "Egress" (since such a policy would not include // an Egress section and would otherwise default to just [ "Ingress" ]). // This field is beta-level in 1.8 // +optional PolicyTypes []networkingv1.PolicyType `json:"policyTypes,omitempty" protobuf:"bytes,4,rep,name=policyTypes,casttype=PolicyType"` }
func (*StagedKubernetesNetworkPolicySpec) DeepCopy ¶
func (in *StagedKubernetesNetworkPolicySpec) DeepCopy() *StagedKubernetesNetworkPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedKubernetesNetworkPolicySpec.
func (*StagedKubernetesNetworkPolicySpec) DeepCopyInto ¶
func (in *StagedKubernetesNetworkPolicySpec) DeepCopyInto(out *StagedKubernetesNetworkPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type StagedNetworkPolicy ¶
type StagedNetworkPolicy struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the Policy. Spec StagedNetworkPolicySpec `json:"spec,omitempty"` }
StagedNetworkPolicy is a staged NetworkPolicy. StagedNetworkPolicy is the Namespaced-equivalent of the StagedGlobalNetworkPolicy.
func NewStagedNetworkPolicy ¶
func NewStagedNetworkPolicy() *StagedNetworkPolicy
NewStagedNetworkPolicy creates a new (zeroed) StagedNetworkPolicy struct with the TypeMetadata initialised to the current version.
func (*StagedNetworkPolicy) DeepCopy ¶
func (in *StagedNetworkPolicy) DeepCopy() *StagedNetworkPolicy
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedNetworkPolicy.
func (*StagedNetworkPolicy) DeepCopyInto ¶
func (in *StagedNetworkPolicy) DeepCopyInto(out *StagedNetworkPolicy)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedNetworkPolicy) DeepCopyObject ¶
func (in *StagedNetworkPolicy) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedNetworkPolicyList ¶
type StagedNetworkPolicyList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []StagedNetworkPolicy `json:"items"` }
StagedNetworkPolicyList contains a list of StagedNetworkPolicy resources.
func NewStagedNetworkPolicyList ¶
func NewStagedNetworkPolicyList() *StagedNetworkPolicyList
NewStagedNetworkPolicyList creates a new (zeroed) StagedNetworkPolicyList struct with the TypeMetadata initialised to the current version.
func (*StagedNetworkPolicyList) DeepCopy ¶
func (in *StagedNetworkPolicyList) DeepCopy() *StagedNetworkPolicyList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedNetworkPolicyList.
func (*StagedNetworkPolicyList) DeepCopyInto ¶
func (in *StagedNetworkPolicyList) DeepCopyInto(out *StagedNetworkPolicyList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*StagedNetworkPolicyList) DeepCopyObject ¶
func (in *StagedNetworkPolicyList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type StagedNetworkPolicySpec ¶
type StagedNetworkPolicySpec struct { // The staged action. If this is omitted, the default is Set. StagedAction StagedAction `json:"stagedAction,omitempty" validate:"omitempty,stagedAction"` // The name of the tier that this policy belongs to. If this is omitted, the default // tier (name is "default") is assumed. The specified tier must exist in order to create // security policies within the tier, the "default" tier is created automatically if it // does not exist, this means for deployments requiring only a single Tier, the tier name // may be omitted on all policy management requests. Tier string `json:"tier,omitempty" validate:"omitempty,name"` // Order is an optional field that specifies the order in which the policy is applied. // Policies with higher "order" are applied after those with lower // order within the same tier. If the order is omitted, it may be considered to be "infinite" - i.e. the // policy will be applied last. Policies with identical order will be applied in // alphanumerical order based on the Policy "Name" within the tier. Order *float64 `json:"order,omitempty"` // The ordered set of ingress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Ingress []Rule `json:"ingress,omitempty" validate:"omitempty,dive"` // The ordered set of egress rules. Each rule contains a set of packet match criteria and // a corresponding action to apply. Egress []Rule `json:"egress,omitempty" validate:"omitempty,dive"` // The selector is an expression used to pick pick out the endpoints that the policy should // be applied to. // // Selector expressions follow this syntax: // // label == "string_literal" -> comparison, e.g. my_label == "foo bar" // label != "string_literal" -> not equal; also matches if label is not present // label in { "a", "b", "c", ... } -> true if the value of label X is one of "a", "b", "c" // label not in { "a", "b", "c", ... } -> true if the value of label X is not one of "a", "b", "c" // has(label_name) -> True if that label is present // ! expr -> negation of expr // expr && expr -> Short-circuit and // expr || expr -> Short-circuit or // ( expr ) -> parens for grouping // all() or the empty selector -> matches all endpoints. // // Label names are allowed to contain alphanumerics, -, _ and /. String literals are more permissive // but they do not support escape characters. // // Examples (with made-up labels): // // type == "webserver" && deployment == "prod" // type in {"frontend", "backend"} // deployment != "dev" // ! has(label_name) Selector string `json:"selector,omitempty" validate:"selector"` // Types indicates whether this policy applies to ingress, or to egress, or to both. When // not explicitly specified (and so the value on creation is empty or nil), Calico defaults // Types according to what Ingress and Egress are present in the policy. The // default is: // // - [ PolicyTypeIngress ], if there are no Egress rules (including the case where there are // also no Ingress rules) // // - [ PolicyTypeEgress ], if there are Egress rules but no Ingress rules // // - [ PolicyTypeIngress, PolicyTypeEgress ], if there are both Ingress and Egress rules. // // When the policy is read back again, Types will always be one of these values, never empty // or nil. Types []PolicyType `json:"types,omitempty" validate:"omitempty,dive,policyType"` // ServiceAccountSelector is an optional field for an expression used to select a pod based on service accounts. ServiceAccountSelector string `json:"serviceAccountSelector,omitempty" validate:"selector"` // PerformanceHints contains a list of hints to Calico's policy engine to // help process the policy more efficiently. Hints never change the // enforcement behaviour of the policy. // // Currently, the only available hint is "AssumeNeededOnEveryNode". When // that hint is set on a policy, Felix will act as if the policy matches // a local endpoint even if it does not. This is useful for "preloading" // any large static policies that are known to be used on every node. // If the policy is _not_ used on a particular node then the work // done to preload the policy (and to maintain it) is wasted. PerformanceHints []PolicyPerformanceHint `json:"performanceHints,omitempty" validate:"omitempty,unique,dive,oneof=AssumeNeededOnEveryNode"` }
func (*StagedNetworkPolicySpec) DeepCopy ¶
func (in *StagedNetworkPolicySpec) DeepCopy() *StagedNetworkPolicySpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StagedNetworkPolicySpec.
func (*StagedNetworkPolicySpec) DeepCopyInto ¶
func (in *StagedNetworkPolicySpec) DeepCopyInto(out *StagedNetworkPolicySpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ThreatFeedContent ¶
type ThreatFeedContent string
+kubebuilder:validation:Enum=IPSet;DomainNameSet
const ( ThreatFeedContentIPset ThreatFeedContent = "IPSet" ThreatFeedContentDomainNameSet ThreatFeedContent = "DomainNameSet" )
type ThreatFeedFormat ¶
type ThreatFeedFormat struct { NewlineDelimited *ThreatFeedFormatNewlineDelimited `json:"newlineDelimited,omitempty"` JSON *ThreatFeedFormatJSON `json:"json,omitempty" validate:"omitempty"` CSV *ThreatFeedFormatCSV `json:"csv,omitempty" validate:"omitempty"` }
func (*ThreatFeedFormat) DeepCopy ¶
func (in *ThreatFeedFormat) DeepCopy() *ThreatFeedFormat
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ThreatFeedFormat.
func (*ThreatFeedFormat) DeepCopyInto ¶
func (in *ThreatFeedFormat) DeepCopyInto(out *ThreatFeedFormat)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ThreatFeedFormatCSV ¶
type ThreatFeedFormatCSV struct { FieldNum *uint `json:"fieldNum,omitempty" validate:"required_without=FieldName"` FieldName string `json:"fieldName,omitempty" validate:"required_without=FieldNum"` Header bool `json:"header,omitempty"` ColumnDelimiter string `json:"columnDelimiter,omitempty"` CommentDelimiter string `json:"commentDelimiter,omitempty"` RecordSize int `json:"recordSize,omitempty" validate:"omitempty,gt=0"` DisableRecordSizeValidation bool `json:"disableRecordSizeValidation,omitempty"` }
func (*ThreatFeedFormatCSV) DeepCopy ¶
func (in *ThreatFeedFormatCSV) DeepCopy() *ThreatFeedFormatCSV
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ThreatFeedFormatCSV.
func (*ThreatFeedFormatCSV) DeepCopyInto ¶
func (in *ThreatFeedFormatCSV) DeepCopyInto(out *ThreatFeedFormatCSV)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ThreatFeedFormatJSON ¶
type ThreatFeedFormatJSON struct {
Path string `json:"path,omitempty" validate:"required"`
}
func (*ThreatFeedFormatJSON) DeepCopy ¶
func (in *ThreatFeedFormatJSON) DeepCopy() *ThreatFeedFormatJSON
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ThreatFeedFormatJSON.
func (*ThreatFeedFormatJSON) DeepCopyInto ¶
func (in *ThreatFeedFormatJSON) DeepCopyInto(out *ThreatFeedFormatJSON)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ThreatFeedFormatNewlineDelimited ¶
type ThreatFeedFormatNewlineDelimited struct{}
func (*ThreatFeedFormatNewlineDelimited) DeepCopy ¶
func (in *ThreatFeedFormatNewlineDelimited) DeepCopy() *ThreatFeedFormatNewlineDelimited
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ThreatFeedFormatNewlineDelimited.
func (*ThreatFeedFormatNewlineDelimited) DeepCopyInto ¶
func (in *ThreatFeedFormatNewlineDelimited) DeepCopyInto(out *ThreatFeedFormatNewlineDelimited)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ThreatFeedMode ¶
type ThreatFeedMode string
+kubebuilder:validation:Enum=Enabled;Disabled
const ( ThreatFeedModeEnabled ThreatFeedMode = "Enabled" ThreatFeedModeDisabled ThreatFeedMode = "Disabled" )
type ThreatFeedType ¶
type ThreatFeedType string
+kubebuilder:validation:Enum=Builtin;Custom
const ( ThreatFeedTypeBuiltin ThreatFeedType = "Builtin" ThreatFeedTypeCustom ThreatFeedType = "Custom" )
type Tier ¶
type Tier struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the Tier. Spec TierSpec `json:"spec,omitempty"` }
Tier contains a set of policies that are applied to packets. Multiple tiers may be created and each tier is applied in the order specified in the tier specification. Tier is globally-scoped (i.e. not Namespaced).
func NewTier ¶
func NewTier() *Tier
NewTier creates a new (zeroed) Tier struct with the TypeMetadata initialised to the current version.
func (*Tier) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tier.
func (*Tier) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*Tier) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type TierList ¶
type TierList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []Tier `json:"items"` }
TierList contains a list of Tier resources.
func NewTierList ¶
func NewTierList() *TierList
NewTierList creates a new (zeroed) TierList struct with the TypeMetadata initialised to the current version.
func (*TierList) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TierList.
func (*TierList) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*TierList) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type TierSpec ¶
type TierSpec struct { // Order is an optional field that specifies the order in which the tier is applied. // Tiers with higher "order" are applied after those with lower order. If the order // is omitted, it may be considered to be "infinite" - i.e. the tier will be applied // last. Tiers with identical order will be applied in alphanumerical order based // on the Tier "Name". Order *float64 `json:"order,omitempty"` }
TierSpec contains the specification for a security policy tier resource.
func (*TierSpec) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TierSpec.
func (*TierSpec) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UIDashboard ¶
type UIDashboard struct { // Array of dashboard data DashboardData []DashboardData `json:"dashboardData,omitempty" validate:"omitempty"` }
UIDashboard contains the data for a UI dashboard.
func (*UIDashboard) DeepCopy ¶
func (in *UIDashboard) DeepCopy() *UIDashboard
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UIDashboard.
func (*UIDashboard) DeepCopyInto ¶
func (in *UIDashboard) DeepCopyInto(out *UIDashboard)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UIGraphLayer ¶
type UIGraphLayer struct { // The nodes that are aggregated into a single layer. Nodes []UIGraphNode `json:"nodes" validate:"omitempty,dive"` // A user-configurable icon. If not specified, the default layer icon is used for this layer node. Icon string `json:"icon,omitempty" validate:"omitempty,icon"` // The color used to represent the layer when an Icon has not been specified. Color string `json:"color,omitempty" validate:"omitempty,color"` }
UIGraphLayer contains the data for a UI graph layer.
func (*UIGraphLayer) DeepCopy ¶
func (in *UIGraphLayer) DeepCopy() *UIGraphLayer
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UIGraphLayer.
func (*UIGraphLayer) DeepCopyInto ¶
func (in *UIGraphLayer) DeepCopyInto(out *UIGraphLayer)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UIGraphNode ¶
type UIGraphNode struct { // The node ID. ID string `json:"id" validate:"servicegraphId"` // The node type. Type string `json:"type" validate:"servicegraphNodeType"` // The node name. Name string `json:"name" validate:"serviceGraphNodeName"` // The node namespace. Namespace string `json:"namespace,omitempty" validate:"omitempty,serviceGraphNodeName"` }
UIGraphNode contains details about a graph node so that the UI can render it correctly.
func (*UIGraphNode) DeepCopy ¶
func (in *UIGraphNode) DeepCopy() *UIGraphNode
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UIGraphNode.
func (*UIGraphNode) DeepCopyInto ¶
func (in *UIGraphNode) DeepCopyInto(out *UIGraphNode)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UIGraphNodeView ¶
type UIGraphNodeView struct { UIGraphNode `json:",inline"` // This node is a primary focus of the graph (i.e. the graph contains this node and connected nodes). InFocus *bool `json:"inFocus,omitempty" validate:"omitempty"` // This node is expanded to the next level. This node can, for example, be a layer that is expanded into its // constituent parts. Expanded *bool `json:"expanded,omitempty" validate:"omitempty"` // Whether the ingress/egress connections to/from this node are included in the graph. This effectively brings // more nodes into focus. FollowIngress *bool `json:"followIngress,omitempty" validate:"omitempty"` FollowEgress *bool `json:"followEgress,omitempty" validate:"omitempty"` // Whether the UI should de-emphasize the node when visible. This is just a UI directive and does not correspond to // a backend parameter. Deemphasize *bool `json:"deemphasize,omitempty" validate:"omitempty"` // Whether the UI should hide the node. This is just a UI directive and does not correspond to a backend parameter. Hide *bool `json:"hide,omitempty" validate:"omitempty"` // parameter. HideUnrelated *bool `json:"hideUnrelated,omitempty" validate:"omitempty"` }
UIGraphNodeView contains the view configuration for a specific graph node.
func (*UIGraphNodeView) DeepCopy ¶
func (in *UIGraphNodeView) DeepCopy() *UIGraphNodeView
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UIGraphNodeView.
func (*UIGraphNodeView) DeepCopyInto ¶
func (in *UIGraphNodeView) DeepCopyInto(out *UIGraphNodeView)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UIGraphView ¶
type UIGraphView struct { // Whether ports are expanded. If false, port information is aggregated. ExpandPorts *bool `json:"expandPorts,omitempty" validate:"omitempty"` // Whether or not to automatically follow directly connected nodes. FollowConnectionDirection *bool `json:"followConnectionDirection,omitempty" validate:"omitempty"` // Whether to split HostEndpoints, NetworkSets and Networks into separate ingress and egress nodes or to combine // them. In a service-centric view, splitting these makes the graph clearer. This never splits pods which represent // a true microservice which has ingress and egress connections. SplitIngressEgress *bool `json:"splitIngressEgress,omitempty" validate:"omitempty"` // The set of selectors used to aggregate hosts (Kubernetes nodes). Nodes are aggregated based on the supplied set // of selectors. In the case of overlapping selectors, the order specified in the slice is the order checked and so // the first selector to match is used. The nodes will be aggregated into a graph node with the name specified in // the NamedSelector. HostAggregationSelectors []NamedSelector `json:"hostAggregationSelectors,omitempty" validate:"omitempty,dive"` // Layout type. Semi-arbitrary value used to specify the layout-type/algorithm. For example could specify // different layout algorithms, or click-to-grid. Mostly here for future use. LayoutType string `json:"layoutType,omitempty" validate:"omitempty"` // Positions of graph nodes. Positions []Position `json:"positions,omitempty" validate:"omitempty,dive"` // The set of layer names that are active in this view. Note that layers may be defined, but it is not necessary // to have each layer "active". Corresponds directly to the name of the UISettings resource that contains a layer // definition. Layers []string `json:"layers,omitempty" validate:"omitempty,dive,name"` // Graph node specific view data. This provides information about what is in focus, expanded, hidden, // deemphasized etc. at a per-node level. Nodes []UIGraphNodeView `json:"nodes,omitempty" validate:"omitempty,dive"` }
UIGraphView contains the data for a UI graph view.
func (*UIGraphView) DeepCopy ¶
func (in *UIGraphView) DeepCopy() *UIGraphView
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UIGraphView.
func (*UIGraphView) DeepCopyInto ¶
func (in *UIGraphView) DeepCopyInto(out *UIGraphView)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UISettings ¶
type UISettings struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the UISettings. Spec UISettingsSpec `json:"spec,omitempty"` }
UISettings contains UI settings.
func NewUISettings ¶
func NewUISettings() *UISettings
NewUISettings creates a new (zeroed) UISettings struct with the TypeMetadata initialised to the current version.
func (*UISettings) DeepCopy ¶
func (in *UISettings) DeepCopy() *UISettings
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettings.
func (*UISettings) DeepCopyInto ¶
func (in *UISettings) DeepCopyInto(out *UISettings)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*UISettings) DeepCopyObject ¶
func (in *UISettings) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type UISettingsGroup ¶
type UISettingsGroup struct { metav1.TypeMeta `json:",inline"` // Standard object's metadata. metav1.ObjectMeta `json:"metadata,omitempty"` // Specification of the UISettingsGroup. Spec UISettingsGroupSpec `json:"spec,omitempty"` }
UISettingsGroup contains the settings that dictate how many UI settings may be created for a specific cluster/user combination. UI settings may only be persisted if there is a corresponding UISettingsGroup resource.
func NewUISettingsGroup ¶
func NewUISettingsGroup() *UISettingsGroup
NewUISettingsGroup creates a new (zeroed) UISettingsGroup struct with the TypeMetadata initialised to the current version.
func (*UISettingsGroup) DeepCopy ¶
func (in *UISettingsGroup) DeepCopy() *UISettingsGroup
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettingsGroup.
func (*UISettingsGroup) DeepCopyInto ¶
func (in *UISettingsGroup) DeepCopyInto(out *UISettingsGroup)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*UISettingsGroup) DeepCopyObject ¶
func (in *UISettingsGroup) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type UISettingsGroupList ¶
type UISettingsGroupList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []UISettingsGroup `json:"items"` }
UISettingsGroupList contains a list of UISettingsGroup resources.
func NewUISettingsGroupList ¶
func NewUISettingsGroupList() *UISettingsGroupList
NewUISettingsGroupList creates a new (zeroed) UISettingsGroupList struct with the TypeMetadata initialised to the current version.
func (*UISettingsGroupList) DeepCopy ¶
func (in *UISettingsGroupList) DeepCopy() *UISettingsGroupList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettingsGroupList.
func (*UISettingsGroupList) DeepCopyInto ¶
func (in *UISettingsGroupList) DeepCopyInto(out *UISettingsGroupList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*UISettingsGroupList) DeepCopyObject ¶
func (in *UISettingsGroupList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type UISettingsGroupSpec ¶
type UISettingsGroupSpec struct { // This description is displayed by the UI when asking where to store any UI-specific settings // such as views, layers, dashboards etc. This name should be a short description that relates // the settings to the set of clusters defined below, the set of users or groups that are able to // access to these settings (defined via RBAC) or the set of applications common to the set of // users or groups that can access these settings. // Examples might be: // - "cluster" when these settings apply to the whole cluster // - "global" when these settings apply to all clusters (in an Multi-Cluster environment) // - "security team" if these settings are accessible only to the security group and therefore // applicable to the applications accessible by that team // - "storefront" if these settings are accessible to all users and groups that can access the // storefront set of applications // - "user" if these settings are accessible to only a single user Description string `json:"description" validate:"uiDescription"` // The type of filter to use when listing and watching the UISettings associated with this group. If set to None // a List/watch of UISettings in this group will return all UISettings. If set to User a list/watch of UISettings // in this group will return only UISettings created by the user making the request. // For settings groups that are specific to users and where multiple users may access the settings in this group // we recommend setting this to "User" to avoid cluttering up the UI with settings for other users. // Note this is only a filter. Full lockdown of UISettings for specific users should be handled using appropriate // RBAC. // +kubebuilder:validation:Enum=None;User FilterType string `json:"filterType,omitempty" validate:"omitempty"` }
UISettingsGroupSpec contains the specification for a UISettingsGroup resource.
func (*UISettingsGroupSpec) DeepCopy ¶
func (in *UISettingsGroupSpec) DeepCopy() *UISettingsGroupSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettingsGroupSpec.
func (*UISettingsGroupSpec) DeepCopyInto ¶
func (in *UISettingsGroupSpec) DeepCopyInto(out *UISettingsGroupSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type UISettingsList ¶
type UISettingsList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata"` Items []UISettings `json:"items"` }
UISettingsList contains a list of UISettings resources.
func NewUISettingsList ¶
func NewUISettingsList() *UISettingsList
NewUISettingsList creates a new (zeroed) UISettingsList struct with the TypeMetadata initialised to the current version.
func (*UISettingsList) DeepCopy ¶
func (in *UISettingsList) DeepCopy() *UISettingsList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettingsList.
func (*UISettingsList) DeepCopyInto ¶
func (in *UISettingsList) DeepCopyInto(out *UISettingsList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*UISettingsList) DeepCopyObject ¶
func (in *UISettingsList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type UISettingsSpec ¶
type UISettingsSpec struct { // The settings group. Once configured this cannot be modified. The group must exist. Group string `json:"group" validate:"name"` // This description is displayed by the UI. Description string `json:"description" validate:"uiDescription"` // View data. One of View, Layer or Dashboard should be specified. View *UIGraphView `json:"view,omitempty" validate:"omitempty"` // Layer data. One of View, Layer or Dashboard should be specified. Layer *UIGraphLayer `json:"layer,omitempty" validate:"omitempty"` // Dashboard data. One of View, Layer or Dashboard should be specified. Dashboard *UIDashboard `json:"dashboard,omitempty" validate:"omitempty"` // The user associated with these settings. This is filled in by the APIServer on a create request if the owning // group is filtered by user. Cannot be modified. User string `json:"user,omitempty" validate:"omitempty"` }
UISettingsSpec contains the specification for a UISettings resource.
func (*UISettingsSpec) DeepCopy ¶
func (in *UISettingsSpec) DeepCopy() *UISettingsSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UISettingsSpec.
func (*UISettingsSpec) DeepCopyInto ¶
func (in *UISettingsSpec) DeepCopyInto(out *UISettingsSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type WindowsManageFirewallRulesMode ¶
type WindowsManageFirewallRulesMode string
+kubebuilder:validation:Enum=Enabled;Disabled
const ( WindowsManageFirewallRulesEnabled WindowsManageFirewallRulesMode = "Enabled" WindowsManageFirewallRulesDisabled WindowsManageFirewallRulesMode = "Disabled" )
type WorkloadEndpointControllerConfig ¶
type WorkloadEndpointControllerConfig struct { // ReconcilerPeriod is the period to perform reconciliation with the Calico datastore. [Default: 5m] ReconcilerPeriod *metav1.Duration `json:"reconcilerPeriod,omitempty" validate:"omitempty"` }
WorkloadEndpointControllerConfig configures the workload endpoint controller, which syncs Kubernetes labels to Calico workload endpoints (only used for etcdv3 datastore).
func (*WorkloadEndpointControllerConfig) DeepCopy ¶
func (in *WorkloadEndpointControllerConfig) DeepCopy() *WorkloadEndpointControllerConfig
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadEndpointControllerConfig.
func (*WorkloadEndpointControllerConfig) DeepCopyInto ¶
func (in *WorkloadEndpointControllerConfig) DeepCopyInto(out *WorkloadEndpointControllerConfig)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
Source Files ¶
- alertexception.go
- authenticationreview.go
- authorizationreview.go
- bgpconfig.go
- bgpfilter.go
- bgppeer.go
- blockaffinity.go
- clusterinfo.go
- constants.go
- conversion.go
- deeppacketinspection.go
- doc.go
- egressgatewaypolicy.go
- externalnetwork.go
- felixconfig.go
- globalalert.go
- globalalerttemplate.go
- globalnetworkpolicy.go
- globalnetworkset.go
- globalreport.go
- globalreporttype.go
- globalthreatfeed.go
- hostendpoint.go
- ipamconfig.go
- ippool.go
- ipreservation.go
- kubecontrollersconfig.go
- licensekey.go
- managedcluster.go
- networkpolicy.go
- networkset.go
- nodestatus.go
- packetcapture.go
- policy_common.go
- policyrecommendationscope.go
- profile.go
- register.go
- remoteclusterconfig.go
- reportdata.go
- securityeventwebhook.go
- stagedglobalnetworkpolicy.go
- stagedkubernetesnetworkpolicy.go
- stagednetworkpolicy.go
- tier.go
- uisettings.go
- uisettingsgroup.go
- zz_generated.deepcopy.go
- zz_generated.defaults.go